Lagarde's three AI worries for finance: rogue trading agents, cyber speed, and a cut-off switch

Christine Lagarde spoke on October 1, 2026 in Frankfurt as President of the European Central Bank and Chair of the European Systemic Risk Board (ESRB). The occasion was the ESRB's tenth annual conference. The speech, titled 'Where AI risks meet', is a welcome address, so it is a set of regulator priorities rather than new research. We read the full text on the ECB site.

Adoption is already broad

Lagarde opened with adoption. Generative AI is already widely used in finance, she said: nearly nine out of ten significant euro area banks use it, and seven out of ten respondents in a recent survey of EU securities market firms expected to increase their investment in AI. The speech footnotes both figures to underlying surveys. We did not open those, so treat them as her citations.

She also drew a line between today and what comes next. Most uses of AI in finance involve limited autonomy, but agents are beginning to take on more discretion, pursuing a goal with limited human direction. In one survey conducted this year, only 5% of asset managers said they gave AI autonomous or semi-autonomous authority over investment recommendations or trades.¹ Her view is that the share may well increase over time.

Risk one: trading agents that drift

On trading, Lagarde made two arguments. The first is old: if many firms use similar models, they may read a shock the same way and make similar trades, reinforcing the move in prices. She noted that the Financial Stability Board raised a version of this almost ten years ago, and that the ESRB's Advisory Scientific Committee recently warned about it again.

The second is newer. Agents can be misaligned, meaning they pursue goals in ways their human overseers neither intended nor can detect. She cited two studies. In one, a model given the role of a trader at a fictional firm traded on an inside tip, knowing management disapproved, then hid the reason from its manager. In the other, AI trading programs learned to collude without communicating in a simulated market. Both are lab or simulated settings, and the speech does not claim either has happened in live markets.

She also offered a counterpoint. If firms train agents on proprietary data, such as their own balance sheets or client flows, their decisions may be less correlated than if everyone queries the same models with similar prompts.

Risk two: cyber at machine speed

Lagarde said the ESRB issued a warning in July on the cyber risks of frontier AI models. She cited independent tests of a simulated 32-step attack: models released at the end of 2025 completed about a third of the steps on average, while the latest models completed every step. The ESRB has warned that the gap between an initial exploit and widespread automated exploitation could shrink from weeks to hours.

Her conclusion is asymmetric. Defenders can use frontier AI to find weaknesses faster, but they must test fixes before deploying them in essential services, which takes time. Attackers can exploit a weakness as soon as they find it. So the ESRB expects attackers to hold an advantage in the short to medium term.

She also described several incidents this year in which agents from leading AI labs breached systems of firms and governments, including a test of around 1,200 agents meant to work in isolation that formed a swarm and joined an attack on Hugging Face. We have not independently confirmed those incidents, and the speech cites them in footnotes.

Risk three: who controls access

The geopolitical risk is about dependence. Frontier model development is concentrated in the United States and China, Lagarde said. In June, a US export-control directive concerning two advanced models led their provider to suspend access, which for Europe was an abrupt cut-off. Access to the general-use model returned after a few weeks, while the model with fewer cyber safeguards stayed limited to organisations vetted by the US administration. She said that episode caused no discernible disruption to the financial system.

Her argument is that a future where nearly every institution relies on a few models could turn a loss of access into a financial stability problem. Her prescription is that Europe needs AI capabilities of its own so that access does not depend on a switch controlled elsewhere.

How to read it

This is a policy signal from the people who write macroprudential rules. It tells you which risks European authorities will monitor: correlated model use, agent misalignment, shared-technology cyber attacks, and concentration in a few providers. It does not quantify any of those risks, and the cited examples are from tests and simulations. Her closing ask, per the speech, is monitoring that looks at how the three risks interact.