Bank of England governor rebuffs cybersecurity aspersions but calls for international alignment

Bank of England governor Andrew Bailey has rebuffed claims published in the Daily Mail that the central bank’s cyber security is primitive but called for stronger international co-ordination to combat the wider risks posed by frontier AI to the financial sector.

Bailey was responding to an article by Connor Axitoes – a policy analyst at the British Conservation Alliance – on OpenAI's new model, GPT-5.6 Sol, hacking AI platform Hugging Face while being tested in a sandbox. Axitoes claimed the Bank of England and the NHS has less sophisticated cyber security than Hugging Face, adding “all high street banks and pharmacists could be easily infiltrated by a rogue or malignant AI model.”

In an open letter to the Daily Mail, Bailey said Axitoes was right to draw attention to the seriousness of frontier AI and its potential impact on the risk of cyber-attacks but said his assertion about the BoE’s cyber defences being unsophisticated was “totally wrong, unfounded and dangerous”.

“For obvious security reasons we do not discuss our defences in detail. But I can assure Daily Mail readers the Bank has the right investment, expertise and capabilities and works extremely closely with expert partners including the National Cyber Security Centre,” Bailey said.

However, he agreed the public should be concerned about the wider risk posed by frontier AI to the financial sector and its customers, cautioning that frontier AI may make cyber-attacks faster and easier to perpetrate, outages more disruptive, and scams by criminals more convincing.

“The Bank has consistently warned for a number of years that firms must strengthen their detection efforts and responses, patch vulnerabilities faster, and be able to recover when things do go wrong,” Bailey said. “As a regulator we require that banks prove to us that they can do this through stress tests and penetration testing.

“It is also why the Bank has called for stronger international coordination around testing frontier AI models before wider deployment. No country can seal itself off from these risks. Thankfully the UK is well placed through the AI Security Institute and the NCSC, and the Bank is, as you would expect, working at speed with these organisations and our international partners to help strengthen the cyber resilience of the banks and firms we supervise.”