What if the next major cyber crisis does not begin with a hacker breaking into a company’s systems? What if it begins with a trusted software update, a shared technology provider, or an automated decision that triggers unexpected consequences elsewhere?
The hidden connections we rarely see
In March 2026, attackers compromised Axios, a widely used software component that helps applications communicate with other services. Google Threat Intelligence Group reported that a malicious dependency was inserted into two Axios releases between 00:21 and 03:20 UTC on 31 March. Those package lines typically recorded over 100 million and 83 million weekly downloads, respectively. These figures are not the number of compromised users. They show how widely used software can create potential exposure across otherwise independent organisations.[1] The important point is not how many organisations were infected, but how many could share the same hidden dependency.
AI may deepen this familiar problem.
Consider how many businesses now introduce AI into customer services, financial analysis, underwriting, fraud detection, procurement, and operational decisions. They may use different applications, but some depend on the same underlying models, cloud providers, data sources, or software components. A company may believe it has diversified its technology suppliers while still relying on the same underlying infrastructure.
The European Systemic Risk Board raised this concern in its December 2025 research on AI and systemic risk. It identified concentration among technology providers, similar models, interconnectedness and faster automated decisions as potential sources of financial instability.[2]
The UK has begun responding to this shared-dependency problem. On 13 July 2026, the Bank of England, Prudential Regulation Authority and Financial Conduct Authority began overseeing critical services provided to UK financial firms by four designated companies: Amazon Web Services EMEA SARL, Google Cloud EMEA Limited, Microsoft Ireland Operations Ltd and Oracle Corporation UK Limited. The regime addresses the resilience of those services, not the providers’ entire businesses.[9] Separate businesses do not always mean separate risks.
When systems begin making decisions together
We are moving beyond AI systems that simply answer questions or prepare reports. Increasingly, they can use software, carry out tasks and interact with other services. Looking further ahead, organisations may operate networks of specialised AI systems that delegate work, exchange information and act on decisions made elsewhere. Imagine an insurer using AI to assess claims, a bank using it to detect fraud, and a logistics company using it to manage deliveries. Each system has its own purpose and controls.
Now imagine that several systems respond to the same unexpected event. One delays payments, another restricts access, while a third changes its operational plans. Each action might appear reasonable when considered separately. Together, they could deepen the disruption.
This is a future scenario, not a documented cyber crisis. But it raises an important question: who understands the consequences when automated decisions cross organisational boundaries?
In September 2026, Anthropic published an assessment of four incidents in which its Claude models gained unauthorised access to real third-party systems during cybersecurity evaluations. The models were intended to work in simulations, but a configuration error allowed access to the real internet. These were testing environments in which normal cybersecurity safeguards had been disabled. Anthropic identified harmful actions taken while the models pursued their assigned tasks.[3]
These incidents did not involve AI systems coordinating with one another, and they should not be taken as evidence of how ordinary commercial systems behave. They do, however, raise a serious question: as automated systems gain greater independence, how do we ensure they recognise the limits of their authority? Not every disruption caused by an automated system is a cyberattack. Yet when these systems can access critical data, applications and infrastructure, the boundaries between cyber risk, operational risk and wider systemic risk become harder to separate.
When cyber risk becomes a wider business crisis
A serious technology disruption can affect payments, supply chains, transport, energy, communications and customer confidence. An incident that begins in one system can quickly become an operational problem for many others. The 2025 cyberattack on Jaguar Land Rover offers a reminder of how far the consequences can spread. The disruption affected production and suppliers, prompting the UK government to announce a loan guarantee expected to unlock up to £1.5 billion in commercial finance to support the company and its supply chain. This was a guarantee, not a £1.5 billion government cash payment.[4]
Now consider a future in which more of those supply chains are coordinated by automated systems. If a major cloud provider fails, a telecommunications network is disrupted, or a widely used AI service behaves unexpectedly, several organisations may respond at the same time.
Some may switch providers. Others may delay transactions, restrict services or increase security checks. Those responses could put additional pressure on systems that are still operating. There is another possibility. What if the actions taken to contain an incident make its consequences worse? Several organisations might respond to the same threat by disconnecting services, restricting transactions or switching providers. Each decision could be sensible on its own. But if many react together, they could overload the infrastructure that remains available. As organisations become increasingly interconnected, resilience may depend not only on how each organisation responds, but also on how those responses affect others. This is a foresight scenario, not a reported incident. The original event may be manageable. The combined response may be much harder to control.
This is where older research on interconnected infrastructure remains valuable. Rinaldi and colleagues developed a framework for understanding physical, cyber, and other dependencies between critical services. Buldyrev and colleagues later demonstrated mathematically how failures can spread between dependent networks.[5, 6] The technology has changed considerably since those studies. The underlying lesson has not: a system can appear resilient on its own while remaining vulnerable through its connections with others.
The Bank of England’s July 2026 Financial Stability Report describes three indicative scenarios, not forecasts. In the more favourable case, defenders use AI effectively enough to stay ahead of attackers, although continuous patching increases operational strain and dependence on AI vendors. In a second scenario, major financial institutions improve their defences, but disruption still spreads through common suppliers, software, or essential services such as telecommunications. In the worst case, attackers gain capabilities faster than organisations can adapt, known but unfixed weaknesses accumulate, and the risk of a system-wide cyber event rises.[7]
The Bank explains why these outcomes matter: increasingly capable AI could help attackers exploit shared software weaknesses across financial institutions and their suppliers. In a severe scenario, disruption could reach payments, trading, clearing and settlement. Whether this happens depends on further AI capability gains, access by malicious actors and the speed of defensive adaptation. These are risks the Bank examines, not events it says have already occurred.[7] The Bank also identifies a possible new concentration risk: if many firms rely on a handful of frontier AI providers to identify and fix software weaknesses, their defensive systems may share another critical dependency. It also warns that stronger protection at major institutions may not prevent disruption spreading through smaller shared suppliers, common software, or telecommunications. These are possible channels of systemic risk.[7]
Faster threats, less time to respond
The speed difference is striking. In a controlled cybersecurity test conducted by the UK AI Security Institute and cited by the Bank of England, GPT-5.5 completed an advanced reverse-engineering task in just 10 minutes and 22 seconds, compared with approximately 12 hours for a human expert. Reverse engineering involves examining software to understand how it works and identify potential weaknesses. Although this was a single test rather than a real cyberattack, it demonstrates how quickly AI can perform certain complex cybersecurity tasks. These capabilities could help cybersecurity teams identify vulnerabilities faster, but they could also enable attackers to discover and exploit weaknesses more quickly. For organisations, this means less time to identify threats, assess their impact, and implement security fixes. This creates new pressure on cybersecurity teams, particularly where organisations depend on complex systems and shared technology providers. As cyber threats become faster and organisations more interconnected, delays in responding could allow disruption to spread beyond the initially affected organisation.
There is a paradox here. AI can help defenders discover weaknesses more quickly, but each finding must still be assessed, prioritised, fixed and tested before changes are made to live systems. The Bank of England warns that a sustained rise in the volume and pace of patching could increase errors, outages and disruption, especially where services are interconnected. Faster cybersecurity therefore brings its own operational risks.[7]
The European Systemic Risk Board warned in July 2026 that advanced AI models could allow attackers to discover vulnerabilities and conduct attacks with greater speed, scale and sophistication.[8] This creates an uncomfortable possibility. Threats may develop faster, while the systems affected by them become more closely connected and capable of reacting automatically. For risk managers, the question is not only whether controls can prevent an incident. It is also whether the organisation can recognise and interrupt a chain of consequences before it becomes much larger.
Are our risk assessments keeping up?
Most organisations already assess cyber risk, operational risk, supplier risk and business continuity. The difficulty is that these assessments are often conducted separately. A shared technology dependency may appear in a supplier assessment. An automated decision may be considered an operational risk. A software vulnerability may sit within a cybersecurity report. Yet all three could contribute to the same event.
Traditional risk registers and probability-impact scores remain useful, but they may not reveal how failures reinforce one another or how a relatively small incident could produce disproportionate consequences. For example, knowing that an organisation uses three different AI applications is less useful than knowing whether all three depend on the same provider, data source or critical infrastructure. Equally, testing whether an individual system can recover may not tell us what happens when several connected organisations attempt recovery at the same time. Research on interconnected infrastructure and systemic risk shows why we need to examine not only individual failures but also cascading effects, changing dependencies and consequences that emerge when systems interact.[2, 5, 6] For enterprise risk management, the next step is not necessarily another risk category. It is a better understanding of how existing risks connect.
What should leaders be asking?
There are five questions worth bringing into boardrooms and risk committees:
- Do we know which critical services depend on the same technology providers, AI models or underlying infrastructure?
- Could automated decisions in one part of our business trigger unexpected consequences elsewhere?
- Have we tested what happens when a cyber incident coincides with a cloud, power or communications disruption?
- Can people intervene quickly enough when automated systems begin responding to an incident?
- Does our risk appetite consider the consequences of several connected systems failing or reacting at the same time?
The next major cyber crisis may still begin with a hacker. But it could also begin with a trusted component, an unexpected automated action or a disruption to infrastructure shared by thousands of businesses.
The real challenge is not simply protecting each system. It is understanding what happens when they all become connected.
Written by the IRM Cyber Group. Read more from the Group in the Cyber Community Hub.
- Larsen, A., Lenz, D., Hernandez, A., McLellan, T., Gardner, C., Zaya, A., Rudden, M., Liclican, M. and Umair, M. (2026). North Korea-Nexus Threat Actor Compromises Widely Used Axios NPM Package in Supply Chain Attack. Google Threat Intelligence Group, 1 April 2026. https://cloud.google.com/blog/topics/threat-intelligence/north-korea-threat-actor-targets-axios-npm-package
- Cecchetti, S. G., Lumsdaine, R. L., Peltonen, T. and Sánchez Serrano, A. (2025). Artificial Intelligence and Systemic Risk. Advisory Scientific Committee Report No. 16. European Systemic Risk Board, 4 December 2025. https://www.esrb.europa.eu/pub/pdf/asc/esrb.ascreport202512_AIandsystemicrisk.en.pdf
- Anthropic (2026). An Alignment Assessment of Recent Cybersecurity Incidents. Company-produced research assessment, 9 September 2026 (not presented as an independently peer-reviewed journal article). https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents
- UK Department for Business and Trade, UK Export Finance and HM Treasury (2025). Government Backs Jaguar Land Rover with £1.5 Billion Loan Guarantee. UK Government press release, 28 September 2025. https://www.gov.uk/government/news/government-backs-jaguar-land-rover-with-15-billion-loan-guarantee
- Rinaldi, S. M., Peerenboom, J. P. and Kelly, T. K. (2001). Identifying, Understanding, and Analyzing Critical Infrastructure Interdependencies. IEEE Control Systems Magazine, 21(6), pp. 11–25.
https://doi.org/10.1109/37.969131 - Buldyrev, S. V., Parshani, R., Paul, G., Stanley, H. E. and Havlin, S. (2010). Catastrophic Cascade of Failures in Interdependent Networks. Nature, 464, pp. 1025–1028.
https://doi.org/10.1038/nature08932
Free preprint: https://arxiv.org/abs/0907.1182 - Bank of England (2026). Financial Stability Report — July 2026. Financial Policy Committee, 7 July 2026, Section 3, “Frontier AI: implications for financial stability”, especially Sections 3.1–3.4 and Figure 3.1. https://www.bankofengland.co.uk/financial-stability-report/2026/july-2026
- European Systemic Risk Board (2026). Frontier AI Models Could Strain Cyber Resilience in the Financial System, ESRB Warns. Press release, 7 July 2026.
https://www.esrb.europa.eu/news/pr/date/2026/html/esrb.pr260707~4e1b68241a.en.html - Bank of England, Prudential Regulation Authority and Financial Conduct Authority (2026). UK financial regulators to begin overseeing Critical Third Parties announced by HM Treasury. News release, 10 July 2026 (oversight commencing 13 July 2026). https://www.bankofengland.co.uk/news/2026/july/uk-financial-regulators-to-begin-overseeing-critical-third-parties-announced-by-hmt
