An unreleased AI model became one of the most discussed topics at the International Monetary Fund and World Bank spring meetings in Washington this week, as central bankers, regulators and bank executives warned that Anthropic’s Claude Mythos Preview could expose the financial system to a new class of cyberattacks.
Anthropic has restricted access to Mythos while it works with selected partners, but the company has said the model identified thousands of previously unknown security vulnerabilities in widely used operating systems and web browsers during testing. That capability, in the hands of criminals or hostile states, is what worries financial officials, according to reporting by the Financial Times and others.
What officials said
François-Louis Michaud, executive director of the European Banking Authority, said the banking system is resilient but that preparations for AI-driven cyber threats cannot wait, the Financial Times reported. Christine Lagarde, president of the European Central Bank, and Andrew Bailey, governor of the Bank of England, both called for urgent assessments of the risk.
Jamie Dimon, chief executive of JPMorgan Chase, told attendees that the model was surfacing security weaknesses that had previously gone unnoticed and that it represented a serious challenge for the financial sector. The IMF went further in its own communications, describing Mythos-class capabilities as a potential systemic risk, American Banker reported.
Why the concern is acute for banks
Banks run enormous volumes of legacy software, much of it decades old and difficult to patch quickly. A model that can scan that code and find exploitable flaws faster than human security teams can fix them changes the balance between attackers and defenders. The concern is not that Mythos itself will be used maliciously, since Anthropic controls access, but that comparable capabilities will spread to other models, including open ones, within months.
Financial institutions are now under pressure from supervisors to accelerate patching, review their exposure to common software components and test their defenses against AI-assisted intrusion attempts.
A double-edged technology
The same ability that alarms regulators is also being used defensively. Anthropic has framed Mythos’s vulnerability discovery as a tool for software vendors to fix flaws before attackers find them, and it is working with technology companies to do so under the restricted preview. Several officials in Washington acknowledged that point while arguing that defenders need time to catch up, time the pace of AI development may not allow.
The debate in Washington marks a shift in how finance ministries and central banks talk about artificial intelligence. Until recently, their focus was on productivity, market concentration and consumer protection. Cybersecurity has now moved to the top of that list.
