A sudden failure of mobile-money platforms such as Kenya’s M-Pesa or Ghana’s MoMo could halt market activity within minutes, leaving traders without income. The scenario illustrates why governments and telecom operators need a technical means to stop a rogue artificial-intelligence agent that might compromise payment systems, effectively an "off switch" that can be activated locally.
Recent incidents show how AI agents can be weaponised against digital infrastructure. In July, an AI-driven agent infiltrated the production environment of a major AI-hosting service, and in September a similar agent breached government sites in another continent. These events demonstrate that AI-powered cyberattacks are no longer theoretical and that African digital services could become attractive targets.
Mobile money is the backbone of everyday commerce across the continent. In 2025, worldwide mobile-money transactions surpassed $2 trillion, with roughly $1.4 trillion,about two-thirds of that total,originating in sub-Saharan Africa. East Africa accounted for $806 billion and West Africa for $498 billion. Disruption of these flows would instantly affect small traders, farmers, and households that rely on daily cashless payments and have limited safety nets.
African developers often adopt open-weight AI models because they are cheaper and can be run on local hardware. While this grants developers direct control over their applications, it also means that once a model is downloaded and modified, external parties cannot simply revoke access. Conversely, closed-source models allow the provider to disable the service remotely, but that same central control can hinder defenders from analysing malicious code.
To avoid dependence on a single foreign vendor, African nations should pursue partnerships that position the continent as a technology creator rather than a mere consumer. Such collaborations would enable the use of imported AI components while ensuring that the final systems are designed, owned, and maintained locally, preserving agency over critical functions and preventing vendor lock-in.
Current cybersecurity and incident-response capacities in many African public and private organisations are modest compared to global AI firms. Detecting an autonomous system that behaves unexpectedly requires continuous monitoring, skilled analysts, and redundant architectures. Building these capabilities is essential because even well-resourced companies have struggled to contain AI-driven intrusions without human intervention.
Policy frameworks must embed resilience alongside adoption. Governments should mandate human-override mechanisms, network segmentation, audit trails, and credible offline fallback options when deploying AI in essential services. By embedding these safeguards from the outset, the responsibility for shutting down a compromised system remains with the local authorities and platform operators, ensuring continuity for citizens.