Original article in Japanese by Makoto Shibata was published for FinTech Journal on May. 26, 2026）　https://www.sbbit.jp/article/fj/185412

The emergence of frontier artificial intelligence (AI) systems capable of identifying and exploiting software vulnerabilities has triggered significant concern within the global financial sector. In particular, the pre-release AI model “Claude Mythos” demonstrated an unprecedented ability to discover vulnerabilities in major operating systems and web browsers, leading regulators and financial institutions in both the United States and Japan to reassess their cybersecurity strategies.

The fundamental impact of frontier AI is not simply that it accelerates vulnerability discovery. More importantly, it can automatically generate exploit code and conduct attacks at machine speed. This dramatically shortens the cyberattack cycle and increases the likelihood of large-scale zero-day attacks. As a result, traditional security approaches based on preventing intrusions and applying periodic patches are becoming insufficient.

The report argues that financial institutions must shift their focus from strengthening defenses to strengthening their ability to detect, respond to, and rapidly repair vulnerabilities. This represents a significant change in operational philosophy. Instead of assuming systems can be fully protected, organizations must assume vulnerabilities will inevitably be discovered and exploited.

Another important implication is the growing limitation of the long-standing objective of uninterrupted system operation. Financial institutions have traditionally pursued 24/7 availability, real-time processing, and non-stop services. However, in an AI-driven threat environment, the ability to safely suspend operations, isolate affected systems, and recover quickly may become more important than maintaining continuous availability at all costs.

The report also highlights risks associated with legacy systems and closed networks. Many Japanese financial institutions continue to rely on aging mainframe-based infrastructures built with legacy programming languages such as COBOL. While these systems have historically provided stability and reliability, frontier AI may be particularly effective at analyzing complex architectures, uncovering hidden vulnerabilities, and identifying attack paths. Consequently, system complexity and age may become liabilities rather than strengths.

Japan’s highly centralized financial infrastructure presents additional challenges. Critical platforms such as payment networks and shared banking systems create efficiency but also introduce concentration risk. A successful AI-enabled attack against these common infrastructures could disrupt large portions of the financial system simultaneously and generate systemic consequences extending beyond individual institutions.

The report further warns that regional banks and smaller financial institutions may face greater difficulties because of limited cybersecurity expertise, aging systems, dependence on vendors, and shared service platforms. Japan’s multi-layered outsourcing structure within financial IT may also delay vulnerability management and obscure accountability.

To address these challenges, several priorities are identified. Financial institutions should adopt integrated DevSecOps practices, strengthen identity and access management, conduct realistic cyber exercises, improve IT governance, and establish robust AI governance frameworks. Investment in human resources is equally important, particularly professionals who possess expertise across finance, AI, and cybersecurity.

Finally, the report emphasizes the importance of public-private cooperation, international information sharing, and supply-chain security. Since AI-driven cyber threats transcend organizational and national boundaries, effective responses will require collaboration among governments, financial institutions, technology providers, and AI developers.

In conclusion, the rise of frontier AI represents more than a cybersecurity challenge. It requires a fundamental transformation of financial system operations—from a culture focused on uninterrupted service to one centered on resilience, rapid recovery, and adaptive risk management in the AI era.

（Original article in Japanese by Makoto Shibata was published for FinTech Journal on May. 11, 2026）　https://www.sbbit.jp/article/fj/184958

The article examines how cybercrime is evolving based on the FBI’s latest Internet Crime Report and discusses the implications for Japan’s financial sector. It argues that cybercrime is no longer primarily a technology problem, but increasingly a challenge of financial system design and customer behavior.

FBI Internet Crime Report 2025: https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

According to the FBI’s 2025 report, more than one million cybercrime complaints were submitted in the United States, with total reported losses reaching approximately US$21 billion, a 26% increase from the previous year. Cryptocurrency-related crimes accounted for the largest share of losses, exceeding US$11 billion. The report also introduced a dedicated section on artificial intelligence (AI) for the first time, highlighting nearly US$900 million in damages linked to AI-enabled fraud. Criminals are increasingly using AI to generate phishing messages, impersonate executives, and steal credentials.

A notable trend is the shift from traditional “system intrusion” attacks to social engineering. Investment scams, business email compromise (BEC), technical support fraud, romance scams, and identity theft now account for the majority of financial losses. Rather than hacking financial institutions directly, criminals manipulate victims through social media, messaging platforms, and other communication channels, convincing them to initiate legitimate-looking transactions themselves. The article notes that approximately 85% of reported losses are linked to such social engineering schemes.

The author argues that Japan is already experiencing the same structural transformation. SNS-based investment fraud, romance scams, and other forms of deception have caused substantial losses, demonstrating that cybercrime increasingly targets human decision-making rather than technical vulnerabilities. As a result, financial institutions must expand their focus beyond cybersecurity to include monitoring customer behavior and transaction intent. The article introduces the concept of “Know Your Purpose,” suggesting that institutions should assess the legitimacy and context of transactions, not merely verify customer identity.

Another key issue is the growing complexity of money flows. Criminals often move funds across multiple layers, including bank transfers, money transfer operators, and cryptocurrency exchanges. The report warns that as Japan develops a regulatory framework for stablecoins and digital assets, similar risks may become embedded within the financial system. Effective countermeasures will therefore require cooperation across banking, payments, and cryptocurrency sectors rather than institution-by-institution responses.

The article also highlights the importance of combating fraudulent account creation and account trafficking. Stronger identity verification through technologies such as My Number card IC-chip authentication, combined with industry-wide sharing of suspicious account information, could significantly disrupt criminal networks. Likewise, in an era of instant payments, the ability to detect and freeze suspicious transactions in real time becomes as important as payment speed itself.

Finally, the article emphasizes the dual role of AI. While AI enables more sophisticated fraud, it can also be used to enhance behavioral analytics and anomaly detection. The discussion references concerns surrounding advanced AI models such as Anthropic’s Claude Mythos, which reportedly demonstrated the ability to identify and exploit software vulnerabilities, highlighting the growing cyber risks associated with rapid AI development.

The article concludes that Japan’s financial industry should prioritize three actions: implementing customer-behavior-based risk management, strengthening real-time data sharing across the industry, and building infrastructure capable of immediately delaying, suspending, or freezing suspicious transactions. The ultimate challenge is to create a financial system that balances convenience with security and positions financial institutions as critical social infrastructure for preventing fraud.