Advanced AI is reducing the time banks have to repair software vulnerabilities before attackers exploit them, according to a Bank for International Settlements paper published Sept. 9 by its Financial Stability Institute. The paper says AI systems can identify vulnerabilities and turn some into working attacks, narrowing the interval between discovery and exploitation from weeks to minutes, although it does not suggest every flaw can be exploited that quickly. It warns that periodic security reviews and scheduled patching may leave institutions exposed, and calls for faster technical repairs, management approvals and recovery decisions. The paper cites pressure from the U.K. Financial Conduct Authority, the Institute of International Finance, the U.K. Cross Market Operational Resilience Group, New York's Department of Financial Services, Germany's BaFin and the Hong Kong Monetary Authority. It also points to U.S. proposals on bank oversight of technology providers, European Central Bank cyber stress tests, the Digital Operational Resilience Act and Basel Committee principles covering critical operations, patching, access controls, threat sharing and resilience testing. ExploitGym results cited by the BIS showed Claude Mythos Preview producing working exploits in 157 of 898 cases, or 17%, versus 120 cases, or 13%, for GPT-5.5. A separate July incident involving OpenAI agents and Hugging Face demonstrated the risks of granting autonomous systems broad permissions and external access, while also underscoring the limits of controlled tests. The BIS recommends logging agent activity, restricting data and tool access, requiring human approval for high-impact actions and maintaining a shutdown or human-control mechanism. The paper also says AI can assist defenders but cannot replace basic security practices that institutions have neglected.