FSB warns G20: frontier AI changes cyber economics

The body that coordinates financial regulation across the G20 just put frontier AI cyber risk at the top of its worry list. Not model bias, not job displacement, not valuations — the cost curve of attacking things. And the reason the Financial Stability Board thinks a software problem becomes a systemic one is a phrase every small business should recognize: everybody depends on the same handful of providers.

What actually happened

FSB Chair Andrew Bailey published his letter to G20 Finance Ministers and Central Bank Governors on August 31, ahead of their meetings on August 31 and September 1.

The FSB's summary of the frontier AI section is direct. Frontier models now show increasingly sophisticated autonomy and problem-solving — and threat capabilities along with them. Bailey names the impact on cyber risk as the most immediate concern, warning that frontier AI may materially alter the "speed, scale and economics of cyber risk."

That last word is the one worth sitting with. Not capability — economics. Attacks that were previously uneconomic against a small target become worth running when the marginal cost of running one more falls far enough.

The transmission mechanism the letter identifies is concentration. The financial system is interconnected, and cyber disruption spreads across jurisdictions through common technology providers, shared infrastructure, and cross-border activity. The asks: jurisdictions should prioritize safe and responsible model release and deployment, and firms should maintain robust response and recovery capabilities — including resilience among critical third-party technology providers.

Why frontier AI cyber risk matters for your business

You are not systemically important. The mechanism still applies to you, because you run on the same shared infrastructure the FSB is worried about.

Write down the list. Most small commerce operations we work with sit on roughly five load-bearing vendors: a store platform, a payment processor, a DNS and edge provider, one cloud, one email sender. Add a model vendor now. Any single one of those going down takes your revenue to zero for the duration, and none of them are yours.

Two things follow from the economics argument specifically.

The floor on who is worth attacking dropped. The comfortable assumption — we're too small to be a target — was always about attacker labor cost, not about you. When reconnaissance, phishing copy, and vulnerability discovery get cheap enough to run at scale, "too small to bother with" stops being a defense. This is not hypothetical; it is the same shift that made credential stuffing universal a decade ago.

Resilience is a manual path, not a better vendor. The FSB's ask of firms is response and recovery, not prevention. That translates cleanly: for each of your five providers, can you take an order, get paid, and tell a customer what is happening while it is down? A phone number and a card reader in a drawer is a real answer. A written page that says who calls whom is a real answer. A second vendor you have never tested is not.

Then do the boring three. Multi-factor everywhere that touches money or DNS. Backups you have actually restored from, once, on purpose. A written list of every provider with an account you cannot lose, and who owns the recovery for each. Nothing on that list requires you to have an opinion about frontier models.

Sources: FSB Chair's letter to G20 Finance Ministers and Central Bank Governors, August 2026, FSB Chair warns of risks arising from frontier AI models.