Federal Reserve’s Bowman warns banks on AI cybersecurity risks and benefits

Federal Reserve Vice Chair for Supervision Michelle Bowman told banks on Thursday that artificial intelligence is simultaneously their best new weapon against cyberattacks and one of the most dangerous tools in the hands of bad actors. The message, delivered at a Financial Stability Oversight Council roundtable on May 1, landed with particular weight given the broader scramble across Wall Street to figure out what frontier AI models mean for the financial system.

Bowman singled out Anthropic’s Mythos AI model as a case study in duality. The same frontier model that can detect vulnerabilities in banking infrastructure can, without adequate supervision, be repurposed by malicious entities to exploit those same systems.

Wall Street’s AI anxiety goes all the way to the top

Bowman’s remarks didn’t arrive in a vacuum. In April 2026, Treasury Secretary Scott Bessent and Fed Chair Jerome Powell convened a series of meetings with the CEOs of JPMorgan Chase, Citigroup, Bank of America, and Goldman Sachs. The agenda: Mythos-related cybersecurity risks and how the largest financial institutions should prepare for a world where AI models grow more capable by the quarter.

Jamie Dimon, JPMorgan’s chief executive, has called cybersecurity the bank’s biggest risk for years. He characterized the current moment as a “transitory period” in which AI’s capabilities are advancing faster than the industry’s defensive posture can adapt.

The Fed itself has been tracking AI adoption across financial institutions for nearly a decade. But the recent leap in generative and agentic AI capabilities has outpaced existing regulatory frameworks. Bowman acknowledged as much, noting that the Fed’s current model risk management guidance was revised before generative and agentic AI technologies entered mainstream use.

Smaller banks face a resource gap

One of the sharpest points in Bowman’s address was the disparity between large and small institutions. Bowman has consistently championed the needs of smaller banks throughout 2026, and her FSOC remarks continued that theme. She pointed to the Federal Financial Institutions Examination Council as a vehicle for providing targeted support to institutions that lack the scale to independently develop advanced AI defenses.

The Fed is also engaging with major payment networks, including Mastercard and Visa, to ensure that the AI-driven security improvements flowing into the largest banks don’t leave the rest of the financial system exposed.

Regulatory frameworks scramble to catch up

Bowman’s call for modernized supervisory approaches reflects a broader tension across global financial regulation. Existing model risk management guidelines were designed with traditional statistical models in mind, not large language models that can generate code, simulate social engineering attacks, or autonomously execute multi-step workflows.

Agentic AI, where models don’t just answer questions but take actions, poses a particularly thorny challenge for regulators. If an AI agent can independently initiate transactions, modify risk parameters, or interact with external systems, the traditional framework of human-in-the-loop oversight starts to break down. Bowman signaled that the Fed recognizes this gap and is working to close it, though she stopped short of proposing specific new rules.

Meanwhile, the meetings between Bessent, Powell, and Wall Street’s top executives suggest that frontier AI risk has been elevated to a systemic concern at the highest levels of US financial policymaking. When the Treasury Secretary and the Fed Chair are sitting down with bank CEOs to discuss a specific AI model by name, that’s no longer a theoretical conversation about future risk.