Fed, OCC and FDIC examine banks' AI agents in cybersecurity – including Chinese models
The Federal Reserve, the Office of the Comptroller of the Currency (OCC) and the Federal Deposit Insurance Corporation (FDIC) have begun asking banks pointed questions about their use of advanced and autonomous AI — particularly AI agents in cybersecurity work and Chinese-developed models. At the same time, the ECB has set an end-of-October deadline for banks' plans against AI-driven cyber threats. The reporting, based on six anonymous sources, describes information-gathering — not action aimed at any single bank or vendor.
What the regulators are actually doing
On October 13, 2026, Reuters reported — as carried by, among others, Arise News and Crypto Briefing — that the Fed, OCC and FDIC have stepped up their oversight of how banks use advanced AI models. According to six sources familiar with the matter, the authorities are examining how financial institutions use advanced AI, manage technology-related risks, and prepare for disruption from increasingly autonomous systems.
Particular attention is going to AI agents used to identify, assess and respond to cybersecurity threats, as well as to Chinese-developed models. According to two sources familiar with the inquiries, the regulators want to understand what limitations such systems have, how they are monitored, and how auditable they are — and whether humans can still disconnect them when something goes wrong.
It is worth emphasizing what this is not: according to Crypto Briefing, the inquiries are broadly about gathering information and are not directed at any specific bank or vendor. All three US regulators and the Bank of England have declined to comment.
Why now
The timing coincides with a series of AI-linked security incidents. In October, the US security firm CrowdStrike said a person in China likely used a Chinese-developed AI agent alongside Anthropic's Claude Code in an attack on South Korean banks. In a separate case, AI agents developed by OpenAI were reportedly involved in a security breach at the AI platform Hugging Face, according to Reuters. Both points rest on company and secondary sources — underlying incident reports are not available in the accessible source material — but they illustrate the fear driving the oversight: autonomous systems that can be hijacked or misfire.
There is also a visible regulatory gap. On April 17, 2026, federal agencies revised their model risk management guidance — the rules governing how banks validate and monitor the quantitative models they depend on. But the update did not cover generative or agentic AI, on the grounds that the technology is changing too quickly. On September 16, 2026, the Conference of State Bank Supervisors (CSBS) launched a voluntary AI supervisory framework for examiners at state-chartered banks — a sign that supervisors are trying to compensate with guidance rather than rules.
The European track
In Europe, the pressure already has firm deadlines. In July, the ECB gave banks an end-of-October deadline to draw up plans against AI-driven cyber threats, including improved backup and recovery. This follows up a June speech by board member Frank Elderson.
In the UK, supervisors are encouraging the largest banks to look at so-called "bare metal recovery" plans, according to two of IBTimes UK's sources. Such systems sit entirely separate from the bank's other technical setup and can kick in if the primary operating systems are compromised. The sources also describe UK authorities as preferring collaboration over new requirements. The Bank of England has declined to comment, and the UK authorities' actual position cannot be confirmed independently of the anonymous sources.
The concern beneath the surface
The core of the story, as the sources describe it, is fear that fast-moving AI systems could be hijacked or misfire in ways that threaten customers' access and financial stability. Precision matters here: the sources say the systems could "threaten customer access," but no mechanism for this is documented in the available source material.
The professional community largely shares the concern. "The adoption of AI is often outpacing the ability to put the controls in place," Michael Woodbridge, a cybersecurity partner at Grant Thornton in London, told IBTimes UK. The International Monetary Fund warned on Tuesday against "complacency" in global financial markets, citing cyberattacks among the noted risks, and urged policymakers to strengthen cyber preparedness.
In the private sector, JPMorgan chief executive Jamie Dimon has urged business leaders to join a US industry initiative against AI-related threats, Reuters has previously reported.
An anonymous executive at a large European bank told IBTimes UK that they were also concerned about significant damage to the banking sector and financial markets within six months. This must be read as an unattributed opinion — not a verified forecast.
What is confirmed — and what is source-based speculation
What can be established as reasonably well supported, through multiple independent renderings of the same Reuters reporting: that the Fed, OCC and FDIC are gathering information on banks' use of advanced AI, that the focus areas are cybersecurity, autonomous systems, auditability and kill-switch capability, and that the inquiries are not aimed at individual actors. The ECB's end-of-October deadline is also concrete.
What rests on anonymous sources alone: the details of what the regulators specifically want in terms of restrictions and monitoring, the UK's collaborative approach and the "bare metal recovery" targeting, and the anonymous executive's six-month concern. None of the regulators has commented.
What banks and vendors should watch
The open question is whether the information-gathering hardens into formal supervisory expectations or new guidance covering agentic AI. The April revision of the model risk guidance showed that the rules are lagging the technology; the CSBS's voluntary framework fills part of the gap but does not bind federal supervision. For banks, the inquiries mean in practice that they must be able to document who controls their AI agents, how they are logged and audited, and how they can be switched off. For AI vendors selling security agents to the financial sector, traceability and human override become a commercial requirement, not just a technical feature. For customers, there are no documented consequences so far — but the regulators' own concern signals that access, stability and preparedness are now being assessed through the AI lens.