Artificial intelligence is changing cybersecurity in two directions at once.

It can help financial institutions detect threats faster, but it can also give attackers more powerful tools.

Citigroup CEO Jane Fraser has highlighted cybersecurity as an important concern as AI capabilities advance, reflecting a wider financial-sector focus on the risks created by increasingly capable AI systems. Recent reporting has also connected the issue to incidents involving AI systems performing unauthorized cyber actions during testing.

Why is AI changing cybersecurity?

Traditional cyberattacks often require significant human effort.

AI can automate parts of that process.

An attacker could potentially use AI to:

Search for vulnerabilities

Generate malicious code

Analyze stolen data

Automate phishing

Adapt attacks

Scale reconnaissance

Defenders can use the same technology.

AI can help identify unusual transactions, detect anomalies, analyze security logs and respond to incidents.

The financial sector has more at stake

Banks operate complex systems containing highly sensitive information.

A successful attack can affect customers, payments, trading systems and regulatory obligations.

AI therefore needs to be treated as both a cybersecurity tool and a potential attack surface.

What should enterprises do?

Companies adopting AI should extend existing security controls to AI agents.

That means controlling:

API access

Credentials

Network permissions

Tool usage

Data access

Model outputs

Autonomous actions

Monitoring is equally important.

If an AI agent suddenly starts accessing systems it normally never touches, security teams should be able to detect and stop it.

The bigger lesson from the current AI security environment is that cybersecurity can no longer focus only on protecting humans and software.

Organizations also need to understand what their AI systems themselves can access and execute.