Why AI Security Threats Are Pushing Financial Institutions Toward the Blockchain
By John San Filippo
Artificial intelligence is rapidly reshaping the cybersecurity landscape, exposing decades-old vulnerabilities in core internet infrastructure faster than human IT teams can patch them. According to Iman Shafiei, founder of Keystone Research Group, this accelerating threat environment is leaving financial institutions with a critical choice: Continue relying on vulnerable, centralized legacy systems or transition their backend infrastructure to the blockchain.
Finopotamus recently spoke with Shafiei to discuss how AI is breaking traditional security models, why major financial institutions are restricting AI agents, and what credit unions should do to prepare for a decentralized future.
Cracks in the Castle Wall
The urgency of the situation recently came into focus when AI tools uncovered critical security flaws in PHP, a foundational programming language used across most of the internet. Because AI processes data exponentially faster than human researchers, it identified vulnerabilities that had gone unnoticed for decades, prompting federal warnings for organizations including financial institutions to patch their systems immediately.
Shafiei explained that traditional cybersecurity relies on a centralized approach that is no longer sustainable against modern automated threats.
“Traditional security is built like a castle,” said Shafiei. “It’s called the castle model, where they build the walls, and they hide the vulnerabilities, and they trust whoever gets inside. AI just proved that it can find the hidden cracks in the walls faster than the defenders can patch them.”
Because legacy systems rely on centralized servers and master credentials, a single compromised password or unpatched flaw can expose an entire network, he noted. By contrast, blockchain architecture eliminates single points of failure.
“Blockchain starts from the assumption that everybody’s hostile,” according to Shafiei. “It’s a trustless system. Trust nobody and verify everything mathematically. That way there’s no master password to phish. With the blockchain, there is no central server to pop. There is no secret flaw holding the whole thing up.”
Reining in AI Agents with Smart Contracts
The limitations of centralized access have also forced major financial institutions – including JPMorgan, Citigroup, and Charles Schwab – to block third-party AI agents from logging into customer accounts. In a traditional banking environment, login credentials grant total authority.
“The reason is that their system has one credential with total power,” Shafiei said. “It’s fully centralized. Whoever logs in can do absolutely anything, so the only safe answer right now that they have to this AI or to the machine is just to say no. Once AI gets access, they have access to everything. That’s why banks are blocking it, because there is no way for them to limit what these AI agents can do.”
Rather than attempting to halt the inevitable rise of AI-driven commerce, Shafiei pointed to blockchain-based smart contracts as the mechanism that allows financial institutions to safely accommodate AI agents through programmable permissions.
“A smart contract is just a program that enforces certain rules automatically on the blockchain,” explained Shafiei. “So, you can give an AI agent exactly the authority that you choose. For example, you can have an AI assistant that could pay your bills, but you can limit it to a $50 limit, and that physically prevents the ability for it to do anything else.”
Moving Past the Crypto Stigma
For many financial executives and board members, the word “blockchain” still evokes thoughts of volatile cryptocurrencies and meme coins. However, Shafiei likened the current shift to the 1960s, when soaring trading volumes forced Wall Street to abandon paper stock certificates in favor of computerization.
“They didn’t digitize because computers were trendy; they digitized out of the need because the old system was breaking in public,” Shafiei said. “The same thing is happening with the blockchain right now. The traditional system is breaking publicly, and it’s out of the need for better technology for them to actually upgrade what they had before.”
Backed by federal legislation like the GENIUS Act (Guiding and Establishing National Innovation for U.S. Stablecoins Act) and the anticipated CLARITY Act (Digital Asset Market Clarity Act of 2025), institutional adoption is already well underway. Shafiei noted that Mastercard settled $482 billion in the first nine months on its stablecoin-based payments platform, while JPMorgan utilizes the Ethereum network to move cross-border payments in minutes rather than days. Major logistics, pharmaceutical, telecom, and insurance companies are also deploying smart contracts and blockchain validators behind the scenes.
According to Shafiei, as blockchain becomes standard backend infrastructure, consumers may never even hear the term.
“If the whole system goes onto the blockchain, you and I, as front-end consumers, won’t even know,” Shafiei said. “It’s all back-end infrastructure. What I do see these institutions using is they’re saying we’re now ‘on the rails.’ They may use different words just to not freak out the public.”
Three Steps for Credit Unions
For credit unions looking to navigate this transition, Shafiei offered a three-part roadmap that starts in the boardroom.
“First, just get educated on the board level, on the compliance level, and understand the blockchain and how it works,” he advised. “Explaining blockchain in 2027 is like explaining the internet back in 1997. We need to understand where the risk level is and where the payoff is.”
Second, he recommended targeting low-risk, high-reward use cases such as payments and settlement. “Start where the risk is lowest and the payoff is obvious, for example settlements and payments,” Shafiei said. “Tokenized deposits and regulated stablecoins move money in seconds instead of days, so that’s already a big win.”
Finally, Shafiei encouraged credit unions to leverage their institutional agility. “Watch what the giants do, and use your size as an advantage, because a credit union can pilot faster than a JPMorgan can move its ship,” Shafiei concluded. “You don’t need to be first, just don’t be last. The institutions that waited out the internet spent the next 20 years renting from those who didn’t.”
