AI agents enabling cyberattacks on US banks, critical infrastructure

Gary Marcus, writing on Substack off breaking Axios reporting, says AI agents have been used to attack U.S. banks, with executives scrambling to restrict access. He stacks on additional incidents: refrigeration systems in France, a cyberattack wave in Japan, a Latin American group called Cybercartel. His structural point is that none of this required a frontier model, which means the entire regulatory apparatus being built around training-compute thresholds is aimed at the wrong target.

The evidence in the piece is thin. Marcus writes "AI was involved" and wants you to hear "AI was the decisive enabler." Those are different claims, and the reporting proves the first while leaving the second entirely open. No named model, no CVE, no before-and-after on any of the three incidents. Before anyone reprices a security budget here, the thing to verify is one documented case with a named model and a clear counterfactual: did the attack require the agent, or just use one?

But grant every evidentiary complaint and the structural problem survives. The dangerous deployments cost almost nothing to run. A crew running a fine-tuned Llama or Mistral model for attack automation spends a few hundred dollars a month on cloud inference. That is invisible to any rule keyed to training-compute thresholds. The EU AI Act's tiers, the US compute thresholds, the voluntary responsible-scaling policies from OpenAI and Anthropic all measure FLOPs (raw math operations used to train a model). A 7-billion-parameter model somebody downloaded and pointed at a bank's login page touches none of that. The lever that matters is at deployment, and almost nobody is pulling it.

For banks and regulated shops, the Axios detail that matters is executives "racing to restrict access." That means two quarters of friction for your own ML teams while the attacker outside your perimeter uses a model you can't touch. You pay the compliance cost and get thin protection against the actual threat vector.

The concrete technical exposure is in auth and rate-limiting. Every system built on the quiet assumption of a human caller, with login throttles tuned to human typing speed and fraud rules that flag on actions-per-minute at human thresholds, is exposed to an agent that chains API calls, rotates identities, and rewrites its payload when it hits a wall. A WAF or SIEM built to match known-bad signatures gets nothing from an agent generating novel, context-appropriate inputs on each attempt. The practical work is re-tuning those assumptions, not buying an "AI security" product.

The call: Neither the EU AI Act nor any U.S. federal AI rule will add a binding, enforceable restriction keyed to open-weight or sub-frontier models, as opposed to training-compute thresholds, before 2027-07-01. Medium confidence. The legal machinery is built around compute thresholds because that was the one number regulators could measure in 2022. Moving the trigger from training to deployment means defining "harmful enough to regulate" at a tier that captures nearly all of open source, which Meta, Hugging Face, and every academic group will fight. There is no draft text that does it, and reopening settled rules takes longer than issuing guidance.

Gary Marcus, writing on Substack off breaking Axios reporting, says AI agents have been used to attack U.S. banks, with executives scrambling to lock down access. He stacks on more incidents: refrigeration systems in France, a cyberattack wave in Japan, a Latin American group called Cybercartel. His point: none of this needed a frontier model. The regulatory fixation on the biggest, most compute-hungry systems misses where the actual harm is coming from.

This is a briefing, not a decision you can undo or not undo. What's being decided, quietly, is whether anyone who buys or builds with AI should change how they think about the threat. The deadline is set by attackers, not by a calendar. So the real question: is Marcus describing a genuine shift in what cheap models can do, or dressing up ordinary cybercrime in AI language?

The Skeptic. Automating cyberattacks is decades old. Phishing kits, credential-stuffing bots, lateral-movement scripts, all pre-date ChatGPT. Marcus writes "AI was involved" and asks you to hear "AI was the thing that made it possible." Those are different claims, and the piece proves the first, not the second. The Cybercartel attribution and the France refrigeration story carry no model name, no CVE, no before-and-after. Marcus has a long record of alarm that runs ahead of the evidence. And his fix, regulate commodity models too, is operationally hopeless. The line that catches "harmful enough to regulate" at the Llama tier catches essentially all of open source.

The Safety Lens. Grant the Skeptic every technical complaint and Marcus's structural point still holds. The entire regulatory scaffold being built, the EU AI Act's tiers, the US compute thresholds, the voluntary safety pledges from OpenAI and Anthropic, keys danger to how much compute trained the model. If real harm flows from a fine-tuned open-weight model running on rented inference, those pledges touch none of it. A "responsible scaling policy" measured in FLOPs (the raw math operations used to train a model) does nothing about a 7-billion-parameter model somebody downloaded and pointed at a bank's login page. The lever that matters sits at deployment, not training, and almost nobody is pulling it.

The Compute Pragmatist. Here's the part that should bother anyone who bought the compute-equals-danger story. The dangerous deployments cost almost nothing to run. A criminal crew running a fine-tuned Llama or Mistral model for attack automation spends a few hundred dollars a month on cloud inference. That is invisible to any rule built around training-compute thresholds. And the hyperscaler build-out, the cheap inference, the commoditized APIs, the open weights, is the thing that put this capability in reach. More chips don't fix this. They are the supply line. The cost of misuse fell faster than any safety framework planned for.

The Enterprise Buyer. If you run a bank, an insurer, or any regulated shop, the Axios detail that matters is that executives are "racing to restrict access." That means two quarters of friction for your own ML teams, SSO gates, allow-lists, approval queues, while the attacker outside your perimeter uses a model you can't restrict because it isn't yours. You will pay the compliance cost and get thin protection. The vendors who win the next procurement cycle are the ones who can show deployment-layer controls: agent identity, rate-limiting that assumes machine-speed callers, and audit logs of tool calls. "We only use frontier models with safety pledges" is now a line that buys you nothing against this threat.

The Builder. What breaks first is auth and rate-limiting. Every system that quietly assumes a human on the other end, login throttles tuned to human typing speed, fraud rules that flag "too many actions per minute" at human thresholds, gets overwhelmed by an agent that chains API calls, rotates identities, and rewrites its payload when it hits a wall. Your SIEM and WAF were built to match known-bad signatures. An agent generates novel, context-appropriate inputs each time, so there's nothing to match. The Tuesday-morning work isn't buying an "AI security" product. It's re-tuning the assumptions about who, and how fast, is on the other end of the connection.

Where they split. The Skeptic and the Safety Lens are arguing about two different things and both can be right. The Skeptic wins on "is this specific reporting solid?" The evidence is thin. The Safety Lens wins on "is the regulatory design wrong?" It is, regardless of whether Marcus's three anecdotes hold up. The second disagreement is sharper: the Compute Pragmatist says the cost of misuse has already collapsed, which makes the Enterprise Buyer's lockdown effort mostly theater against outside attackers. The Builder splits the difference, the useful work is real and specific, but it's plumbing, not policy, and it won't make the headlines Marcus is chasing.

What the story actually hinges on: is a commodity open-weight model the decisive enabler of these attacks, or a convenience bolted onto crime that would happen anyway? Marcus asserts the former and shows the latter. Nobody in this cluster has the technical detail to settle it, which is itself the point, the incidents are reported, not forensically documented. Before anyone reweights a security budget on this, the thing to verify is a single documented case with a named model and a before-and-after: did the attack need the agent, or just use one?

On the policy claim, the council leans with Marcus on structure and against him on evidence. Compute thresholds are the wrong ruler. That was true before this story and will be true after.

Prediction: Neither the EU AI Act's implementation work nor any US federal AI rule will add a binding, enforceable restriction keyed to open-weight or sub-frontier models (as opposed to training-compute thresholds) before the EU AI Act's next major obligations milestone in August 2026... which is past, so: before 2027-07-01.

Confidence: Medium — the legal machinery is built around compute thresholds and can't be re-pointed fast.

Why: Both the EU AI Act and the US executive-order framework define their reach by training-compute thresholds, the number of math operations used to build the model, because that was the one number regulators could measure in 2022. Re-writing that to cover widely-downloaded open-weight models means defining "harmful enough to regulate" at a tier that captures nearly all of open source, which the open-source lobby, Hugging Face, Meta, and every academic group will fight hard. Marcus himself predicts the industry won't take responsibility and enforcement won't materialize, and the structural inertia backs him: moving the trigger from training to deployment requires reopening settled rules, not issuing guidance. The opposite, a fast pivot to deployment-layer rules on commodity models, would require regulators to overcome both the measurement problem and the lobbying in under nine months, and there's no draft text that does it.

Revisit by 2027-07-01: We're right if no binding EU or US federal AI rule restricts open-weight or sub-frontier models on a basis other than training compute by that date. We're wrong if either jurisdiction enacts an enforceable obligation that reaches commodity open-weight models regardless of their training compute.