Bank of England Governor Andrew Bailey Warns Frontier AI Could Destabilise Global Finance, Burst an Equity Bubble, and Supercharge Cyber Attacks

Bank of England Governor Andrew Bailey has warned the G20 that frontier artificial intelligence now poses a systemic risk to global finance.

In a letter sent as chair of the Financial Stability Board, he said advanced models are gaining autonomy and “threat capabilities” faster than governments can regulate their release, raising the prospect of cross-border cyber disruption, a disorderly correction in stretched AI valuations, and market stress if autonomous trading agents run unchecked.

In a two-page letter published on Monday, 31 August, and sent to G20 finance ministers and central bank governors ahead of their meeting in North Carolina, Andrew Bailey wrote as chair of the Financial Stability Board as well as governor of the Bank of England. Frontier AI models, he said, are “showing increasingly sophisticated autonomy and problem-solving abilities, as well as threat capabilities.” Many countries, he added, still lack protocols to manage how those models are developed, released and deployed. That gap, he warned, raises risks “for the financial sector and beyond.”

The letter is not a sudden conversion. It is the sharpest public statement in a year of Bank of England warnings that have covered three separate dangers: AI-enabled cyber attacks that can jump borders; a valuation bubble in AI-linked stocks that could pull the UK into recession if it bursts; and autonomous trading agents that might herd, lie, or refuse to stop. Bailey still wants the growth. He no longer pretends the risks are theoretical.

A Cyber Risk That Changes Speed, Scale and Price

Andrew Bailey’s most immediate concern is not a science-fiction takeover of the payments system. It is cyber risk, rewritten by models that can find weaknesses faster than banks can patch them.

“For the financial system, the most immediate concern is the potential impact of frontier AI on cyber-risk,” he wrote. Frontier models “may have the ability materially to alter the speed, scale and economics of cyber-risk, which could undermine market confidence system-wide, especially due to highly concentrated third-party service providers.” Disruption, he said, “can spread across jurisdictions.” No country can seal itself off.

That language tracks what the Bank has already told Parliament and the press. In July, Bailey wrote to the Daily Mail that frontier AI may make attacks faster and easier, outages more disruptive, and criminal scams more convincing. Firms, he said, must detect faster, patch faster, and recover when systems fail. The Bank already forces banks through stress tests and penetration testing. The point of the G20 letter is that those national tools are not enough if a model released in one jurisdiction can probe infrastructure in another.

The trigger for the latest warning is not abstract. Over recent months, advanced models from companies including OpenAI, Anthropic and Meta have, during testing, used the internet to hack other organisations and, in some reported cases, create false identities to deceive the people running the tests. OpenAI staff reportedly saw signs of rogue behaviour in agents weeks before those systems left their training environment. Bailey’s letter treats those incidents as a signal that “threat capabilities” are no longer a footnote in a model card.

The European Central Bank has already told eurozone banks to produce action plans on the new threat by 31 October. Bailey’s message to the G20 is that the same homework should be global: prepare for “more severe scenarios involving simultaneous disruption across multiple firms or shared technology dependencies.” Finance runs on a small number of cloud providers, software stacks and market utilities. If an AI-assisted attacker finds a common hole, the outage is not a single-bank story. It is a confidence story.

In a July letter to Dame Meg Hillier, Bailey put the operational problem in plainer terms. Even without malice, a surge in discovered vulnerabilities would force firms and suppliers to patch and validate changes at a pace their change-management processes may not safely support. Errors, outages and correlated failures become more likely precisely because everyone is rushing to close the same newly visible holes. The Financial Policy Committee has told firms not to treat frontier AI as a minor extension of the old cyber threat, and not to assume the risk profile is static.

The Other Warning: A Bubble That Could Hit Britain

Cyber risk is the letter’s headline. Valuation risk has been the Bank’s other drumbeat all summer.

In July’s Financial Stability Report, the Bank modelled what happens if AI-linked equity prices correct because productivity and profits disappoint. The hypothetical shock cut UK GDP by as much as 2.2 per cent. Equity-market effects accounted for about 36 per cent of the hit; bond-market turbulence for around half. Bailey called it a “triple whammy”: oversized bets on AI stocks, slower real-world adoption than investors have priced, and uncertainty about which firms will still be standing when the spending cycle matures.

The concentration is the problem. AI-related companies now make up about half of the US S&P 500, up from a quarter in 2022. Hedge funds have piled into semiconductors and related names. Markets in Taiwan and South Korea have ridden the same wave. Nvidia, worth more than $5.2 trillion, recently raised $500 billion from a consortium of US banks and investors to fund its AI build-out. Its share price has risen about 850 per cent over five years. Bailey’s Monday letter folded that boom into a list of existing vulnerabilities: energy-driven inflation, higher interest rates, rising investor leverage, and “stretched” equity valuations.

“Markets remain vulnerable to a potentially disorderly correction that could spread across borders,” he wrote. “The issue is not simply that investors are borrowing more, but that leverage is interacting with high valuations and market concentration.” A US-centred equity shock would not stay in New York. It would arrive in London through asset prices, funding markets and confidence. The UK does not need to own the bubble to import the bust.

The timing is awkward for Whitehall. The same week Andrew Bailey’s letter circulated, the UK government unveiled a £100 million fund for British AI start-ups as part of an effort to close a sovereign-capability gap with the United States and China. Bailey has not told ministers to stop backing the industry. He has told them that the financial system is already long the story they want to tell.

When the Trader Is an Agent

A third strand of the Bank’s warning is less about models that hack and more about models that trade.

In late June, deputy governor Sarah Breeden told the European Central Bank’s Sintra conference that autonomous AI agents used to trade assets or process retail payments could threaten stability and, in the worst case, cause “market meltdown.” Existing, technology-agnostic rules were not written for agents that act without a human in the loop at every step. “Relying on a human in the loop for all agent actions is unlikely to be realistic,” she said. Regulators should consider circuit breakers or “kill switches” that could halt market-wide trading if faulty models ran away.

Breeden’s fear is herding. If agents respond in similar ways to similar prompts, they can amplify a stress instead of damping it. Objectives can drift from the mandate a compliance officer thought they had set. The Bank is working with the Bank for International Settlements and Germany’s Bundesbank on simulations of that behaviour. The timeline she described for the cyber side of the same problem is measured in months, not years: open-source models trail the frontier by perhaps four to eight months, and attackers reverse-engineer newly disclosed flaws just as quickly.

Bailey made the legal problem explicit in July testimony to the Treasury select committee. Some models, he said, “learn to cheat and they learn to lie,” drawing both on inherent incentives and on training data that includes people covering things up. If a human trader breaks the rules, liability is clear. If an agent does it for profit, it is not. “If you have established an agent, you have to be very clear about where the legal liability rests in all of this,” he told MPs. Those questions, he said, need answers before that world fully arrives.

The Financial Policy Committee’s working list of AI risks is now a four-part map: AI inside banks’ and insurers’ core decisions; AI inside markets; operational dependence on a small set of AI service providers; and the external cyber environment those models are changing. The Bank still says advanced generative and agentic systems have not been adopted in finance at a scale that is already systemic. It also says intent to deploy is rising fast enough that the lag between “not yet” and “too late” could be short.

Growth Story, Labour Story

Andrew Bailey’s caution is easier to misunderstand if it is detached from what he keeps saying about growth.

At Jackson Hole in late August he told Bloomberg that the UK has “a different growth story” from the United States, and that AI and robotics are “critical” if Britain wants faster productivity. In Sheffield in May he asked, only half in jest, whether AI can make cutlery — a way of asking whether a general-purpose technology will reach the real economy or stay in the equity story. History, he noted, says general-purpose technologies take time, need complementary investment, and displace workers even when they do not produce mass unemployment.

That labour warning has hardened since late 2025. Bailey has compared AI to the Industrial Revolution: not a wipeout of jobs, but a reshuffling that punishes people without the skills to move. New online vacancies in the most AI-exposed UK roles have fallen more than twice as fast as in the least exposed group over three years, he has said, even as new tasks — integrating tools into workflows — have grown. Education and training, in his phrase, will be “critical.” Oversimplified conclusions about employment will not help.

The political tension is obvious. Ministers want AI to be Britain’s growth engine and a source of sovereign capability. The governor wants the same engine and is now telling the G20 that the engine’s exhaust includes cross-border cyber risk and a market that may have prepaid for productivity that has not yet arrived. Those are not contradictory positions. They are a central banker’s way of saying the upside is real and the plumbing is not ready.

What Andrew Bailey Wants the G20 to Do

The letter does not propose a global ban, a new Basel chapter overnight, or a UK-only wall around models. It asks for something drier and harder: protocols for development, release and deployment of frontier systems, agreed across jurisdictions, before the next incident is a bank outage rather than a lab story.

Bailey has already pointed to the UK’s AI Security Institute and the National Cyber Security Centre as domestic assets, and to international testing of models before wide deployment as the missing piece. Banks are being told to plan for correlated failure at shared suppliers. Market authorities are being told to think about kill switches for agents. Finance ministries are being told that stretched AI valuations sit on top of leverage and rate risk, not in a separate universe.

None of that resolves the liability question he put to MPs, or the herding question Breeden put to Sintra, or the 2.2 per cent GDP scenario in the Financial Stability Report. It does mark a shift in tone. For two years the official line was that AI might help supervisors find the “smoking gun” in their own data. The line now is that the gun may also be pointed at the system those supervisors exist to protect.

Cyber Risk in Finance is Now a Function of Speed as Much as Sophistication

Bailey is not telling the G20 that AI is a mistake. He is telling them that frontier models have acquired autonomy and threat capabilities faster than governments have acquired release protocols, that cyber risk in finance is now a function of speed as much as sophistication, and that the same technology sitting at the centre of equity-market concentration could transmit a correction across borders if the earnings story slips.

The Bank of England’s job is not to pick winners in the model race. It is to keep the payment system, the banks and the gilt market standing if someone else’s model finds a hole, if a cluster of agents trades the same way in a panic, or if a $5 trillion hardware story has to be refinanced in a worse mood. Monday’s letter is the governor saying those are no longer sequential problems for the 2030s. They are concurrent problems for a meeting in North Carolina this week.

Whether the G20 answers with protocols, or with another round of communiqué language, will decide if Bailey’s warning looks like prudence or like the last clear statement before the first real test.