Hidden in the Stack: Shared AI Infrastructure, Common-Mode Failures, and Potential Operational Contagion in Global Banking

Abstract

Shared technology suppliers can create common operational exposure across banks, but public evidence rarely identifies when that exposure becomes a cascade or financial contagion. This paper develops a layered, disclosure-based framework that separates four objects: common exposure, common-mode operational shock, potential operational cascade, and realised financial contagion. The main sample is the complete 2025 Financial Stability Board list of 29 global systemically important banks. The source register contains 44 public disclosures and yields 43 unique institution-supplier relationships involving 17 external suppliers through 20 August 2026. Microsoft reaches 10 banks in the all-stage network and Google eight; however, a production-only sensitivity produces an eight-eight tie, showing that deployment-stage classification changes the apparent leader. Deployment-specific look-through paths expand OpenAI's structural reach from three direct institutions to six. Yet only seven of 43 relationships state criticality, six disclose fallback or substitutability, and one reports exit testing. Missing-edge analysis further shows that only three adversarially placed Google relationships would change the leading supplier, while the same number of undisclosed relationships can move concentration in opposite directions depending on whether missingness favours incumbents or challengers. The evidence therefore supports a propagation-ready topology, not a claim of realised financial contagion. The paper's contribution is to identify the information and network conditions required to move from visible co-exposure to a defensible systemic-risk assessment.

Author abstract from the research manuscript. Typography and line breaks have been normalized; the linked source may show a different manuscript version.