Finance leaders of the G7 have agreed to hold tabletop exercises to guard against AI-enabled cyberattacks, Japanese Finance Minister Satsuki Katayama said, according to Reuters. The decision commits the world's seven largest advanced economies to jointly rehearsing their response to a class of threats that security officials warn is growing faster than traditional defenses.
The agreement, announced on Friday, comes as policymakers increasingly seek to coordinate responses to growing cybersecurity risks tied to artificial intelligence. Tabletop exercises — structured simulations in which officials walk through a hypothetical crisis step by step — have become the preferred tool for testing how governments, central banks, and private financial institutions would actually communicate and respond under attack. For the G7, the exercises will focus on the financial sector, where a successful AI-enabled intrusion could move markets before defenders even understand what is happening. For more context on this story, see our ongoing breaking AI news.
An IMF Warning Gave the Exercises Urgency
The move follows a warning from the International Monetary Fund this week that an AI-enabled attack could undermine confidence in a financial institution and ripple through the stability of the system. The IMF's message, as summarized by outlets covering the G7 decision, was that AI lowers the cost and raises the sophistication of attacks on banks, payment systems, and market infrastructure — while the same technology also gives defenders new tools, the offense currently has the easier task.
That asymmetry is what the tabletop exercises are designed to probe. Rather than testing whether antivirus software blocks a payload, the simulations ask harder questions: Who decides to take a major bank offline? How do regulators communicate with markets during the first hours of an incident? When does a cyber event become a financial-stability event requiring central bank liquidity? Those decisions have rarely been rehearsed with AI-specific attack scenarios in mind.
Building on an Existing Cyber Framework
The exercises will run through the G7 Cyber Expert Group, the working group that coordinates cybersecurity policy across the G7's financial authorities. The group has years of experience with cross-border coordination exercises and released guidance this year on AI-related software bills of materials. Giving the CEG an AI-attack mandate formalizes what members had already begun discussing bilaterally as AI-enabled intrusion tools have spread.
Japan's role in announcing the agreement underscores how the debate has shifted from abstract risk to concrete preparation. Earlier this year, Japan's finance ministry had already signaled that the G7 would discuss AI defense standards for financial institutions — Friday's announcement converts that discussion into a committed program of joint exercises.
A Year of Escalating Preparation
Friday's agreement is the culmination of months of groundwork. In July, Japan's finance ministry said the G7 would discuss AI cyber defense standards for financial institutions, and by August the US Treasury was publicly calling to deepen practical cybersecurity cooperation across the G7. The group's cyber authorities ran a formal Cross-Border Coordination Exercise this year — publicized by the Bank of Canada and the UK Treasury — to practice information-sharing during a simulated incident. Adding AI-enabled attacks to that playbook is a natural escalation, and the IMF's warning this week supplied the catalyst.
The timing also reflects a broader regulatory sweep across AI in finance. The Financial Stability Board finalized a set of sound practices for responsible AI adoption by financial institutions this month, and supervisors in several G7 members have warned that AI-driven fraud and model risk are outpacing existing rulebooks. The tabletop exercises extend that work from paper standards to practiced response.
Why Finance Is the First Mover
The financial sector has reasons to move first. It is the most digitized critical industry in the G7 economies, it operates at machine speed, and it is the sector where an attacker's profit motive aligns most directly with national-security damage. The IMF's warning this week centered on exactly that exposure: an AI-enabled attack, the fund cautioned, could undermine confidence in a financial institution — and confidence is the raw material banking runs on.
AI also changes the shape of the incident itself. An AI-driven attack can adapt mid-campaign, generating new lures when one is blocked and probing defenses faster than human operators can respond. That is why tabletop exercises — which force humans to make decisions at human speed — are considered essential: they expose where automation ends and judgment must begin.
What Happens Next
The G7 announcement did not set a public timetable for the first exercise, but the Cyber Expert Group's existing cross-border exercise format gives members a ready-made structure to build on. Plausible scenarios for such simulations include AI-generated disinformation around a bank run, automated attacks on payment infrastructure, and deepfake-enabled fraud against treasury operations — the incident classes financial regulators have flagged most consistently this year.
For banks and insurers, the practical signal is to expect stricter expectations from supervisors. Coordination exercises of this kind historically precede new regulatory guidance, and G7 members have already shown this year they are willing to regulate AI in finance. The tabletop format may be informal, but its output — a documented map of who does what when an AI attack lands — tends to become the playbook regulators later enforce.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
