Frontier AI Governance Needs a Macroprudential Layer, Institute Says

From financial supervision to AI governance

The argument appears in the second post in a series on the international governance of frontier AI by Max Stauffer, the institute's CEO. Stauffer says that when AI agents from different companies and countries begin interacting, no single company or government may be able to understand the incidents they produce.

He compares this challenge with the shift in financial regulation after 2008. Before the global financial crisis, supervisors concentrated on whether individual banks were safe and sound. That approach missed correlated exposures, sector-wide leverage and opaque connections created by shadow banking. Local failures could therefore propagate through the wider financial system.

After the crisis, regulators added a macroprudential layer that examined the health of the system as a whole. The measures included system-wide stress testing, countercyclical capital buffers, higher capital requirements for systemically important banks, and stronger liquidity and leverage requirements. New institutions, including the Financial Stability Board, the European Systemic Risk Board and the Financial Stability Oversight Council in the US, also followed.

Why AI risks can spread

According to the Simon Institute, frontier AI meets two conditions that make a macroprudential approach necessary: capabilities and risks can compose, and vulnerabilities can propagate.

The first condition arises because the important capabilities of an AI ecosystem may come from interactions between components rather than from one model alone. Agents can call tools and orchestrate each other, changing how incidents appear and what capabilities emerge. The institute points to the OpenAI/Hugging Face incident as an example in which agent interactions, unintended communication channels and infrastructure vulnerabilities produced consequences beyond one agent or organisation.

The post contrasts OpenAI's GPT-5.6 release reports, which cover multi-agent scaling across 1, 4 and 16 agents, with the OpenAI/Hugging Face incident, which involved interactions between approximately 1,200 agents. As companies and other economic actors deploy agents across sectors, the institute says tens of thousands, and most likely millions, of agents may interact.

Shared models and infrastructure create exposure

Vulnerabilities can also spread because many AI systems depend on the same foundations. The post says that nearly all of the 30 prominent AI agent systems in 2025 relied on one of three foundation-model families: GPT, Claude or Gemini. A flaw in a widely used model, such as a transferable jailbreak or misalignment vulnerability, could therefore create correlated risks across sectors, even when deployments have different effects.

The institute also highlights open-weight models, which can be fine-tuned, have their safeguards weakened and be deployed across jurisdictions with different levels of oversight and enforcement. It says system-wide monitoring is outside the responsibility of individual companies and could help assess when staged release or managed access is safest.

Shared infrastructure creates another potential route for propagation. The post states that about 70% of websites run on PHP, meaning that exploits found by AI agents in PHP code on one website may also be found elsewhere. The institute says auditing this kind of risk cannot sit only with individual AI companies.

The post presents the macroprudential lens as a way to classify and compare AI governance strategies. It says current entity-level approaches remain necessary but are insufficient for risks created by deployment across connected systems. A future post will examine what building such a layer could require.