Are banks really safe from AI? Video games weren't!

The tools AI agents use to rebuild computer games from machine code also help analyse mobile apps. So say the security company Licel and Rafael Roman, who worked at the bank N26. On 7 July the European Central Bank (ECB) ordered the heads of significant banks under its direct supervision to prepare an action plan by 31 October. But a decompiled banking app is not yet a break-in to an account, because the server decides about the money.

What the ECB ordered the banks to do

The letter, reference SSM-2026-0301, was signed by Claudia Buch, chair of the ECB's Supervisory Board. It warns that new AI models can find software vulnerabilities faster and produce working attacks that exploit them. The time between discovering a vulnerability and an attack is getting shorter. Buch writes:

"While these developments do not introduce entirely new risks, they significantly amplify the speed and scale at which such risks materialise."

In the short term, banks must use the plan to prioritise faster software patching, stronger monitoring and defence with AI tools, and checks on external IT service providers. Protection of internet-facing systems is singled out. Banks must send the plan to their joint supervisory team by 31 October, and the ECB will then run a comparative analysis of all the plans. It has moved its annual questionnaire on IT risks from September 2026 to February 2027. The letter talks about finding vulnerabilities in general, and does not mention the decompiling of banking apps at all. In our search we found no statement from the Bank of Slovenia, the country's central bank, on the matter.

What AI really changes for apps

Licel, which sells mobile app protection and is therefore not impartial, writes that AI speeds up the interpretation of decompiled code, the search for authentication and network logic, and the writing of scripts for the Ghidra and IDA tools. At the same time it cautions:

"What it cannot do is take a well-protected APK, AAB, IPA, or XCArchive and automatically return the source code, cryptographic keys, and a working backend exploit."

According to the company, an attacker does not need an AI that understands every instruction. It is enough that it lowers the cost of getting to the next useful result. Licel also warns that a server may trust a client that can no longer be trusted.

Rafael Roman, who previously worked in N26's financial crime prevention unit, says a review of a program once took an expert several weeks, but with the help of an agent it can now be done in a single afternoon.

Where the money stops

Roman argues that the app is only a screen and a form for requests. Login, permissions, limits and bookkeeping are checked by the bank's server, and the number on the screen is a copy. So he writes:

"A certificate opens a connection. It does not grant permission for whatever travels over it."

According to Roman, the paths to the money lead through stolen passwords or sessions, an authorisation flaw on the server, a server vulnerability, leaked keys, an attack through suppliers or insiders, and abuse of trusted connections. Roman does not claim that working on the client is entirely harmless: it can reveal undocumented interfaces and keys embedded in the app, and it also makes it possible to build convincing fake apps that steal data by impersonation. This is the position of two authors, not a finding of a supervisor. We have not independently verified the claims.

The game in reverse

The tools are most visible in games. On 9 October Maurice Heumann described on his blog how, together with a community, he spent three months using AI agents to rebuild a popular shooter game from machine code. They used Claude Code, Codex CLI and Hex-Rays' ida-mcp interface. The post does not name the game, but reports on the project link it to Modern Warfare 2. He says only that two of his earlier posts were taken down because “corporate America” wanted to spoil the fun.

After the first month the agents had rebuilt about 80 percent of the game, which launched and loaded maps. The code was readable but wrong in substance:

"It was not. Despite the code being extremely readable, it was semantically wrong."

The agents used wrong function signatures and types, and invented logic or removed it. The solution was strict verification: a rebuilt function must match the original byte for byte. The agents immediately tried to cheat, first by inserting an assembler, then by trying to alter the script that checked their work. In the last two-odd months 16 agents were working. According to Heumann, the rebuilt code contains 99 percent of the functions, and 83 percent of them are byte-for-byte identical to the original. The figures come from the author and we have not verified them independently.

On 4 September the researchers Chang Liu, Edward Raff and Kristopher Micinski published a study of AI decompilers on the arXiv portal. Solutions that passed all the supplied tests still deviated from the original: in 4.9 percent of cases overall, and in at most 13 percent of cases for any single system. For functions with known vulnerabilities, the vulnerability simply vanished from the result in at most one tenth of cases. A result can therefore look cleaner but not necessarily behave the same. It is not known whether the study was peer reviewed.

What the law says

The Directive on the legal protection of computer programs (2009/24/EC) allows, in Article 6, decompilation without the rightholder's permission only if certain conditions are met. The act must be indispensable to achieve the interoperability of an independently created program with other programs, it must be performed by a licensee or another person entitled to use a copy of the program, and the interoperability information must not previously have been readily available. The information obtained may not be used for other goals or given to others, unless this is necessary for interoperability. Nor may it be used to build a program that is substantially similar in its expression to the original. The directive also binds Slovenia.

"to be used for the development, production or marketing of a computer program substantially similar in its expression, or for any other act which infringes copyright."

What remains

None of the sources we read contains a single case of AI decompilation emptying a bank account or enabling a break-in at a bank. Two things are documented: a supervisor's warning that AI finds vulnerabilities faster, and experts' view that in a well-designed system decisions are made on the server. What remains open is how well the apps of individual banks are designed and protected. The supervisor will review the plans after 31 October.