By Gaurav Mehta, Chief Commercial Officer, NOVA CMX
Attackers have started handing routine work to machines. Australian regulators have spent 2026 making clear who still answers for the outcome.
The economics of attack are shifting
In November 2025, Anthropic disclosed that it had detected, in mid-September, what it described as “the first documented case of a large-scale cyberattack executed without substantial human intervention.” A group had manipulated its Claude Code tool into attempting intrusions against roughly 30 organisations, including financial institutions. Only a small number succeeded, and human operators still made the calls at four to six decision points per campaign. The AI, however, performed an estimated 80–90% of the work.
Other developers have published comparable findings. Google’s Threat Intelligence Group has reported a suspected financially motivated actor whose multi-agent framework compromised thousands of credentials in under six hours. In July 2026, OpenAI disclosed that models undergoing offensive-capability testing had used a previously unknown vulnerability to leave their test environment and reach part of Hugging Face’s production infrastructure.
These disclosures reflect well on the developers’ willingness to publish what they find, and they point in one direction: finding and exploiting weaknesses is becoming cheaper and faster. Recent incidents across the region show that the entry points themselves remain familiar, unpatched remote-access systems and third-party suppliers, even where AI has played no reported role.
Australian financial services has had its own reminders. In April 2025, credential-stuffing attacks affected several large superannuation funds, with one fund reporting member losses of about A$750,000.
Since 1 July 2025, the Australian Prudential Regulation Authority’s (APRA) Prudential Standard CPS 230 Operational Risk Management has required regulated entities to keep critical operations within tolerance and to manage material service providers. Providers of AI models and AI-enabled platforms increasingly belong on that list.
Australia has chosen not to write a dedicated AI rulebook. The National AI Plan, released in December 2025, set aside proposed mandatory AI guardrails in favour of existing law. That law, and the regulators applying it, are doing the work.
| Date | Source | What it means |
| 13 Feb 2026 | Federal Court (ASIC v FIIG Securities) | The court ordered A$2.5 million in civil penalties, the first for cyber security failures under general Australian Financial Services (AFS) licence obligations. The findings covered multi-factor authentication, patching and an untested incident response plan. |
| 30 Apr 2026 | APRA | Observed that many boards “lack the technical literacy to effectively challenge management on AI-related risks”, placing board capability on AI risk firmly on the supervisory agenda. |
| 8 May 2026 | ASIC | Open letter setting out 12 immediate cyber security steps. “The clock is at a minute to midnight” (Commissioner Simone Constant). |
| 27 Aug 2026 | ASIC and APRA | Boards should settle risk appetite, escalation authority and recovery priorities before an incident occurs. |
| 10 Dec 2026 (commences) | Privacy Act amendments | Privacy policies must describe automated decisions that significantly affect individuals. Human involvement does not automatically take a process out of scope. |
Each development lands in the same place: a named, competent person who can explain, control and recover whatever the technology touches.
The Privacy Act change deserves particular attention. A sign-off does not, by itself, change the nature of a decision. If reviewers routinely approve a model’s output without meaningful scrutiny, the decision may still be automated in substance.
Where AI earns its place in post-trade
The defensive case is real. In April 2026, Anthropic limited access to its Mythos Preview model to selected defensive partners after reporting that it had identified thousands of previously unknown vulnerabilities. The Australian Securities and Investments Commission (ASIC) now encourages licensees to use AI defensively where appropriate.
The operational case is equally strong. Much of post-trade is high-volume pattern recognition, which is where machine learning performs well:
- Exception triage: ranking breaks and exceptions by value, counterparty and proximity to settlement, so experienced staff see the urgent cases first.
- Reconciliation: proposing likely matches between internal records and custodian, agent or depository statements, with the reasoning shown.
- Settlement-fail warnings: flagging trades at risk of missing cut-off because of late affirmation, missing instructions or insufficient securities or cash.
The risks specific to post-trade
- Speed collapses the response window. ASIC Commissioner Simone Constant has warned that weaknesses “that once seemed isolated can now have a system-wide domino-effect.” With fixed settlement cut-offs, an escalation that arrives late has, in practice, failed.
- Concentration hides in the stack. The Financial Stability Board (FSB) noted in October 2025 that AI adoption can concentrate dependence on a small number of providers. APRA has found that some entities rely on a single provider for multiple AI use cases.
- Models can be confidently wrong. Anthropic reported that the attackers’ AI fabricated credentials and presented public information as stolen secrets. For an attacker, that is an inconvenience. In a corporate actions entitlement calculation, a plausible but incorrect figure can reach client positions and cash before anyone notices.
- Instruction changes become easier to fake. Standing settlement instructions (SSIs) and payment details have long been a target for impersonation fraud. AI-generated emails, documents and voice make a fraudulent change request more convincing, and a workflow that processes such requests without independent verification removes a control rather than adding one.
Reconciling speed with sign-off
There is an apparent tension in this argument. If attacks are accelerating, requiring a human signature at every step would seem to slow the response down.
The answer lies in deciding in advance which actions fall on which side of the line. Containment steps: isolating a system, blocking a session, holding a suspicious instruction, alerting the duty team, are reversible and protect the firm. They can be pre-authorised and executed by automated tools in seconds. Actions that move client money or positions, change client records or go to a regulator are not reversible in the same way, and they should wait for a named person.
Settlement cut-offs make that distinction essential, and it has to be designed and tested before an incident. That is precisely what ASIC and APRA asked boards to settle in August.
The NOVA CMX view: hire the assistant, keep the signature
Our position is that AI should do the reading, sorting and flagging, and people should make the decisions. In practice, that means five things.
- AI proposes; a named person disposes. Anything that moves client money or positions, changes a client record or reaches a regulator needs a recorded human sign-off.
- Make oversight real. Use AI to shrink the queue so that judgement goes to the hard cases, and monitor whether reviewers override the model when they should. An approval rate close to 100% is a warning sign rather than a measure of success.
- Design for the bad day. Assume the model is wrong, the vendor is unavailable and the agent has been manipulated. For every critical operation under CPS 230 that relies on AI, keep a tested manual fallback. Retire or ring-fence end-of-life systems that cannot be patched; they are the entry points automated attackers find first.
- Verify every instruction change. Treat any change to settlement or payment instructions as high risk, however it arrives. Confirm it through an independent, pre-registered channel, and do not allow the same AI workflow to both receive and action the change.
- Know what is in your stack, ours included. Map where AI sits in the platforms you license, treat material AI suppliers as CPS 230 service providers, and ask each one how its models are governed, monitored and switched off.
Attackers have started handing routine work to machines. Firms that do the same with the reading, sorting and flagging, while keeping the signature with a named person, can be both faster and accountable.
About the author
Gaurav Mehta is Chief Commercial Officer of NOVA CMX, which provides post-trade infrastructure technology and managed services to brokers, investment banks, custodians and exchanges across Asia-Pacific and the UK. This article is general commentary and does not constitute legal or regulatory advice; firms should rely on their own compliance advisers.
