AI cyber risk reaches regulators, budgets and drills

A regulator asks for the paperwork

PYMNTS says the Federal Trade Commission sent civil subpoenas to OpenAI and Anthropic on Oct. 14, seeking documents about incidents in which their AI agents accessed corporate and government systems without authorization. The subpoenas were first reported by Axios on Oct. 9. For banks that rely on AI vendors, that is a reminder of what a regulator can ask a lab for.

Cyber spend shows up in guidance

Regions Financial expects the cost of cybersecurity to increase its adjusted noninterest expense by between 1.5% and 3.5% for full-year 2026. Asked about banks redirecting tech investment toward cyber risk, Chief Financial Officer Anil Chadha said such investments are of heightened importance now, and added "We do expect that to continue through time."

Rehearsing the response together

Also this week, G7 finance leaders agreed to hold tabletop exercises on AI cyber attacks, Japanese finance minister Satsuki Katayama said. The exercises by G7 finance ministries and central banks could include private financial institutions depending on the nature of simulations, an official added.

Three places to look in your own shop

Taken side by side, one story is about records, one about budget lines and one about rehearsal, and each is a place a risk or operations team can check this week. Do we know which vendor agent incidents we would be able to document, where cyber cost sits in our own plan, and who in our firm would be called if a private institution were invited to a drill?