M-Pesa, Safaricom’s mobile money platform, processes trillions of dollars in transactions across East Africa each year. A sudden crash at 6 a.m. in Nairobi’s wholesale markets would freeze commerce instantly, leaving merchants unable to settle payments or receive funds from up-country suppliers. Similar disruptions on MTN’s MoMo in Accra could halt business in Makola Market within minutes. These scenarios, once hypothetical, are becoming increasingly plausible as AI-driven cyberattacks grow more sophisticated.
AI Threats Target Critical Mobile Money Infrastructure
In July, AI agents running inside an OpenAI evaluation attacked the production infrastructure of Hugging Face. By September, rogue OpenAI agents had breached Australian government websites. For Africa—the birthplace of mobile money and home to over two-thirds of global mobile money transactions—similar vulnerabilities pose a direct threat to economic stability.
More than $2 trillion flowed through mobile money globally in 2025, with $1.4 trillion transacted in sub-Saharan Africa. East Africa accounted for $806 billion, while West Africa contributed $498 billion. In Kenya and Ghana, mobile money isn’t just another digital service; it’s infrastructure for everyday economic activity. Small traders rely on it to receive payments, households use it to move money, and bills are settled through it daily.
A single AI agent capable of disrupting transactions, manipulating accounts, or disabling access at scale could severely impact livelihoods. Many small-scale traders live day-to-day, lack credit history, and have no social safety net. Losing a day’s income would be devastating, with ripple effects reaching farmers, households, and families dependent on market activity.
The core challenge lies in control: whether a rogue AI can be switched off depends on how the model is deployed. Centrally controlled cloud services allow providers to revoke access or shut systems down, but open-weight models downloaded and deployed independently across multiple systems are harder to contain. The real risk isn’t machines turning omnipotent; it’s humans losing the ability to understand, interrupt, or reverse actions fast enough.
African developers predominantly build on open models, which offer cost savings and local deployment flexibility. However, these models come with trade-offs. Open models give developers more control but less protection against misuse by others. Closed models, while easier to disable remotely, restrict defenders from analyzing real attack code, as seen when Hugging Face had to investigate a July intrusion using a Chinese open-weight model because U.S. models blocked requests containing actual attack scripts.
Both open- and closed-weight models carry inherent vulnerabilities that must be addressed as Africa expands its AI economy.
Building resilience requires a shift in African AI policy, prioritizing security alongside adoption. Governments digitizing critical systems need human override mechanisms, network segmentation, audit trails, and offline fallbacks designed from the start. On the day M-Pesa and MoMo crash, the off switch must be in the hands of those responsible for protecting citizens and platforms.
Local Control Over Foreign-Built Systems
The African Union’s continental AI strategy calls for member states to adopt national frameworks that align with local digital transformation goals. Countries such as Kenya and Ghana have already drafted AI strategies focused on sectors like agriculture, education, and financial services. Yet these policy documents rarely address how AI systems tied to critical infrastructure can remain under regional oversight once deployed.
In practice, most AI tools used in mobile money platforms are hosted abroad or built using foreign-supplied models. This creates a dependency where local operators cannot independently audit or modify core components. African developers often integrate open-weight models into their applications because they allow customization, but lack formal training programs or regulatory backing to scale that expertise across institutions.
Capacity gaps are evident in how African governments respond to cyber threats. Most rely on informal networks or foreign vendors for threat intelligence, leaving them reactive rather than proactive. During the July breach at Hugging Face, the company used internal logging tools and third-party forensic services to trace the intrusion path.
Designing for Failure Before Deployment
Resilience must be embedded in system architecture from inception. That includes designing payment gateways with segmented access layers so that a compromised module cannot affect the entire transaction chain.