Anthropic's Mythos AI sparks alarm among transatlantic bank regulators

Canada’s financial regulator has explicitly named Anthropic’s Claude Mythos in an April warning to lenders, breaking with the standard practice of discussing anonymous "emerging technologies." The Office of the Superintendent of Financial Institutions told bank technology and risk officers that the model "significantly compresses the timeframe for effective risk mitigation."

The specific alarm stems from the model's capability to find and exploit software vulnerabilities almost instantly. This collapses the long-standing assumption that cybersecurity teams have days or weeks to patch flaws before they are weaponized. For a banking sector running some of the oldest software infrastructure in the global economy, that timeline reduction is a fundamental threat.

The regulatory anxiety has rapidly crossed borders. In early April, US Treasury Secretary Scott Bessent and then-Federal Reserve Chair Jerome Powell convened American bank chiefs specifically to discuss Mythos. The pattern has since repeated at the European Central Bank and the Bank of England, while Australia's securities regulator confirmed it is monitoring the model.

Access to Mythos is tightly restricted through Anthropic’s Project Glasswing programme. While the Canadian government confirms it has access, euro zone banks appear to be excluded from the system. Canadian lenders have refused to disclose whether they possess the model, with several deferring to the Canadian Bankers Association, which offered only a general statement about cyber risk compliance.

Lenders are simultaneously attempting to monetise the technology while defending against it. Royal Bank of Canada, TD Bank, and BMO are moving from pilot programmes to deploying AI in chatbots and internal systems. Bruce Ross, RBC’s group head of AI, noted that Mythos allows exploits to appear as soon as vulnerabilities are discovered. “The way we’re dealing with it is building our own AI defences,” he said.

Beyond immediate cyberdefence, the episode highlights a growing systemic worry. Prime Minister Mark Carney has compared reliance on a tiny handful of frontier AI vendors to the concentration risk that preceded the 2008 financial crisis. Regulators typically insist they govern risk rather than technology itself, but OSFI’s decision to name Anthropic twice in its bulletin suggests officials are no longer treating that risk as a metaphor.