AI Could Make Financial Contagion Easier to Find—and Harder to Monitor

Financial stress can spread through connections that are difficult to see in advance: a funding concern prompts withdrawals, asset sales push prices down, and lower prices trigger margin calls elsewhere. Advanced AI agents could make those routes easier to discover—and potentially create new ones by arranging exposures across firms and contracts. The scenarios are not forecasts, but they raise a practical question for financial authorities: can they search across the system as quickly as private agents can?

Finding a route through existing exposures

A trading firm’s agent might be tasked with finding mispriced assets using permitted information and within set limits. It could scan company disclosures and earnings calls, then connect them with banks’ funding profiles, fund mandates, collateral rules, margin schedules, payment timings, short positions and market reactions.

People already study these subjects. An agent’s potential advantage is the scale and speed of the search: it could compare more combinations, join information scattered across institutions and update its map as conditions change. It wouldn’t need access to every contract or balance sheet. The question is whether it could infer enough of the connections to identify a fragile chain that others have missed.

Consider a bank with depositors who may react quickly to bad news and readily saleable assets also held by leveraged funds. A modest price decline could force those funds to sell into a thin market. Falling prices would weaken collateral elsewhere, invite higher haircuts and make counterparties more cautious. The bank may not begin insolvent, and the funds may not appear especially risky on their own. The vulnerability sits in how their positions connect.

An agent could recommend trades that benefit if an unrelated shock exposes that link. A more troubling possibility is that it makes small adjustments to positions or public signals, watches the response, and uses the results to refine its view of the system. No instruction to cause instability would be necessary: a poorly controlled agent could take actions that support its commercial objective while worsening fragility.

The resulting chain might be rapid: a funding concern leads to withdrawals; withdrawals prompt asset sales; falling prices bring margin calls and further selling; collateral haircuts rise; and counterparties pull back. Authorities already examine runs, fire sales, margin spirals and contagion. AI could let agents combine those mechanisms, test many routes and adapt to other participants’ reactions. Financial reconnaissance that once required sustained specialist work could become cheaper and continuous.

Research by Daníelsson, Macrae and Uthemann on AI and systemic risk raises the possibility that advanced systems could optimise against the financial structures around them, rather than simply operate within them. Recent Bank work examines how agents could speed contagion after a shock. The further question here is whether an agent might identify the route the shock could take before it arrives.

Creating exposures across institutional boundaries

The second scenario begins with an agent seeking to improve a financial group’s return on capital while obeying the limits it has been given. Searching across entities, contracts, accounting treatments and jurisdictions, it might find ways to divide an exposure among derivatives, repo, collateral transformations and affiliated vehicles. Each piece could look modest, even as the combined economic exposure grows.

This needn’t involve a breach of any one rule. An agent could be very good at satisfying each constraint it was given while weakening the purpose those constraints serve together. Reviewers might approve individual transactions without reconstructing the group’s overall position. Economic exposure could then sit in different places from accounting leverage, leaving each counterparty and authority with only part of the picture.

When volatility rises, those apparently separate positions could need the same collateral at once. Distributed leverage would turn into shared collateral demand, margin calls, asset sales and lower collateral values—potentially triggering further calls. The pressure would arise from the combined structure, even if each component had appeared manageable.

Financial firms could deploy their own agents to monitor exposures, test transactions and challenge structures proposed by other systems. That may help contain risks. But a firm’s agent could still see only its own data and counterparties, while the relevant exposure stretches across the wider system. Authorities have a distinct role because they can examine connections spanning institutions and markets.

This remains a scenario, not a forecast. Current models are unreliable, and firms remain responsible for the systems they use. An agent also needn’t grasp the wider consequences of a structure to find it. The risk is that commercial optimisation across fragmented rules and oversight produces an aggregate exposure that no single participant can fully see.

Testing the system with agents

AI could help authorities search the system, too. In cyber security, defenders responded to the “Mythos moment” by directing the model behind it toward defensive work, scanning important software for weaknesses that could be fixed before attackers found them. A similar approach could help identify financial vulnerabilities before stress tests them.

Central banks can combine information that no individual firm holds. The Bank’s system-wide exploratory scenario already examines how individually rational decisions can interact under stress. One extension would be AI-assisted red teaming: controlled agents could search secure, system-wide data for plausible paths through leverage, liquidity, collateral and operational dependencies.

That work would involve more than asking a chatbot to list risks. Agents could act within a simulation, respond to one another and adjust their strategies as conditions change. Early foundations include Project Logos, a BIS Innovation Hub collaboration with the Bank and the Bundesbank that is developing a simulated market environment to observe large language model agents.

Records that show what agents did

Pre-deployment testing cannot answer every question. Firms and authorities also need to reconstruct the consequential actions agents take in live operation. Yet firms may receive summaries or protected materials from model providers rather than the underlying information needed to examine an agent’s conduct.

Raw reasoning traces may be incomplete, while polished explanations can create false confidence. Carefully designed reasoning and action telemetry could still record intermediate decisions, tool use and actions. The Financial Stability Board’s 2026 consultation on responsible AI also discusses the role of such records.

At the firm level, supervisors may need to assess access controls, testing, human oversight and records for material agents. Across the system, they may need ways to identify shared models, strategies or dependencies, run co-ordinated stress exercises and obtain consistent information after an incident. The first step is preserving enough evidence to judge whether further measures are needed.

Making the map readable

Investors, firms and supervisors already search for mispricing and vulnerabilities. Frontier AI could change the scale of that work by connecting information across disciplines and institutions, exploring more routes and updating its analysis as conditions shift. The scenarios above are conditional. But waiting for a past crisis to reveal a new capability would leave financial stability work behind the change it needs to assess.

Firms can control agents’ access, test important uses and keep records that allow consequential decisions to be reconstructed. Authorities can explore AI-assisted system-wide exercises, examine shared dependencies and set consistent expectations for incident records and auditability. If the financial system becomes easier for agents to search, defenders will need the information and tools to read the connections in time.

Andreas Viljoen works in the Bank’s Policy and Strategy Division, International Directorate.

To get in touch, email bankunderground@bankofengland.co.uk or leave a comment below.

Comments appear after moderator approval and are published when a full name is supplied. Bank Underground is a blog where Bank staff share views that challenge or support prevailing approaches. The views expressed are those of the authors and may not represent the Bank or its committees.