JPMorgan flags cyberattacks, amplified by AI, as a potential catalyst for a new banking shock

JPMorgan Chase is warning that cyberattacks could become a bigger source of systemic stress for banks than investors may be pricing in, arguing that the industry’s long-term risk picture may be missing a key driver of liquidity strain.

The concern, as reported in market coverage of JPMorgan’s views, is that modern attacks may not just cause isolated service disruption. Instead, they could spread quickly enough to trigger funding and liquidity problems, turning a cybersecurity event into a financial stability event. The same coverage also frames cybersecurity as “one of the biggest undiscounted risks” not reflected in bank valuations, suggesting market pricing has yet to fully incorporate the threat.

A parallel development is the growing intersection of artificial intelligence and cyber defense and offense. Industry reporting on AI security programs describes how Anthropic is developing tools intended to help detect vulnerabilities and prevent data incidents, while also noting that threat actors may adapt as AI capabilities advance. That coverage points to heightened urgency among government and financial stakeholders as they consider how AI could change the pace and scale of attacks.

One such example is Anthropic’s “Project Glasswing,” described by the International Association of Privacy Professionals as a program aimed at helping partner companies detect vulnerabilities and get ahead of potential threats. The program is described as using Anthropic’s “Claude Mythos Preview” model, and the partner list cited in that reporting includes major technology and financial firms, including JPMorgan Chase.

The bank’s own public messaging has similarly emphasized that AI can raise the cybersecurity risk environment. The same IAPP report says that JPMorgan Chase CEO Jamie Dimon’s annual letter called attention to growing cybersecurity threats and stated that “AI will almost surely make this risk worse,” while also discussing heightened risks from AI.

For the banking sector, the strategic implication is straightforward but difficult to manage: credit-cycle shocks have long been modeled, while operational and cyber risks can be harder to quantify, harder to insure, and capable of triggering market reactions through confidence and funding channels. Even when a bank’s core balance sheet remains intact, an attack that degrades systems, data integrity, or customer and counterparty access can turn operational disruption into market stress.

Still, JPMorgan did not provide new, granular disclosures in the reported material. The market article summarizes JPMorgan’s broader risk perspective, but it does not lay out specific attack scenarios, internal metrics, or timelines, and the publicly cited coverage does not detail what proportion of costs, exposures, or capital planning assumptions are being adjusted. As a result, investors will likely continue to treat the warning as a qualitative announcement rather than a measurable forecast.