G7 AI cyberattack exercises have been signed off at ministerial level, Japan’s finance minister Satsuki Katayama said in Bangkok. The drills will simulate attacks on the financial system using scenarios built by G7 financial authorities. No start date, participant list or official text has been published.
The decision covers the G7 advanced economies — Canada, France, Germany, Italy, Japan, the United Kingdom and the United States — and was taken at a meeting of finance ministers and central bank governors held on the sidelines of the International Monetary Fund’s annual meetings. Reuters reported it from Bangkok on 16 October 2026.
What the G7 Agreed in Bangkok
The agreement is to hold tabletop exercises modelling cyberattacks that use advanced, or “frontier”, artificial intelligence against the financial system.
Katayama described how it came about: “The G7 finance deputies had been discussing the idea of doing tabletop exercises on frontier AI”, she told reporters, adding that it was signed off at the ministerial level. Deputies are the senior officials who prepare work for ministers.
On the mechanics, a Japanese finance ministry official who was not named said the simulations would be developed by G7 financial authorities, and that private financial institutions may take part depending on the nature of the scenarios. The findings are to be used to test whether existing protocols work and to revise the manuals for handling such incidents where they do not.
There is a precedent inside the G7’s own machinery. One report records that on 18 May 2026 the G7 Cyber Expert Group ran a simulated malware attack on shared technical infrastructure involving 24 organisations. That account comes from a single outlet and has not been confirmed elsewhere.
What Has Not Been Specified
The commitment is real but thinly documented, and the distinction matters for anyone trying to judge what will actually happen.
- No published text: no G7 communiqué or official statement setting out the agreement has been released. What is known comes from Katayama’s remarks to reporters.
- No date: neither a start date nor a schedule for the exercises has been announced.
- No participant list: private-sector involvement is described as possible, not settled, and no bank or market infrastructure has been named.
- No published scenarios: the attack models are to be built by G7 financial authorities, and nothing about their content has been disclosed.
- No stated cost or lead body: no budget has been given and no single institution has been identified as running the programme.
- The day itself is unclear: the Reuters dateline is 16 October 2026, while the report says Katayama spoke “on Thursday”, which was 15 October. The two have not been reconciled.
What a Tabletop Exercise Is
A tabletop exercise is a discussion-based rehearsal, not a live test. Participants sit with a written scenario and work through what they would do, step by step, while facilitators introduce complications. Nothing is actually switched off and no real systems are attacked.
That design is the point and also the limit. It surfaces gaps in decision-making, escalation routes and communication between institutions and regulators cheaply and without operational risk. It does not establish whether the technical defences themselves would hold, which is what a live or “red team” test is for. On the G7’s own description, the output here is revised incident-handling manuals rather than any finding about technical resilience.
The IMF Report Behind the Decision
The exercises follow the IMF’s Global Financial Stability Report, titled Resilience, Risk, and Transformation, released on 13 October 2026 at the same meetings. Our report on the Fund’s global growth forecast of 3.1% covers its companion publication from the same week.
The report says markets have remained resilient while stability risks stay elevated, and it names three risks that could trigger turmoil: corrections in AI-related asset prices, sovereign bond yield shocks driven by resurgent inflation or fiscal concerns, and cyber threats. On the last of those, the Fund states that increasingly sophisticated cyber threats pose growing risks as finance becomes more digital and interconnected.
The report does not attach a probability or a loss estimate to a cyberattack, and it does not call for the G7 exercises. Its two named chapters cover hedge funds and financial stability, and tokenisation. It records that hedge funds hold about $13 trillion in assets globally, more than three times their 2013 level.
What the Bank of England Said Separately
A day or two before the G7 decision, the Bank of England set out a different response to the same threat. Sarah Breeden, its Deputy Governor, told the Institute of International Finance annual meeting in Bangkok on Thursday 15 October 2026 that AI had advanced far enough to pose a “systemic risk” to global financial infrastructure.
Her argument was about recovery rather than defence. “It’s not enough now to assume that the cyber attackers won’t get through”, she said, and lenders should consider the “bare metal recovery options” needed for core services across the whole financial system. Bare metal recovery means standby systems kept fully separate from a bank’s main technology estate, able to take over if the primary operating systems are compromised.
Breeden also said: “Cyber is always the thing that I say keeps me up at night.” Reuters reported earlier in the same week that United Kingdom supervisors have encouraged the largest banks to examine bare metal recovery plans. No rule or deadline has been published, and the encouragement described is supervisory rather than binding.
Frequently Asked Questions
What Are the G7 AI Cyberattack Exercises?
They are tabletop exercises, agreed by G7 finance ministers and central bank governors in Bangkok and reported on 16 October 2026, that will model cyberattacks using advanced artificial intelligence against the financial system. Scenarios are to be built by G7 financial authorities.
When Will the Exercises Start?
No date has been announced as of 18 October 2026, and no G7 communiqué setting out the agreement has been published.
Will Banks Take Part?
Private financial institutions may take part depending on the scenarios, according to an unnamed Japanese finance ministry official. No institution has been named and participation has not been confirmed.
What Did the IMF Say About Cyber Risk?
In its Global Financial Stability Report of 13 October 2026, the IMF named cyber threats as one of three salient risks to financial stability, alongside AI-related asset price corrections and sovereign bond yield shocks. It attached no probability or loss estimate.
