Why Anthropic’s Mythos AI has financial regulators, central banks on edge

Financial regulators across major economies are stepping up scrutiny of a powerful new artificial intelligence model developed by Anthropic, amid growing concerns that its advanced capabilities could expose vulnerabilities in critical financial and digital systems.

Authorities in Japan, Europe, India, and other regions are coordinating responses as the model, known as Mythos, raises fresh questions about cybersecurity risks in an increasingly AI-driven world.

Japan convenes top lenders and regulators

In Japan, the Financial Services Agency on Wednesday said it will hold a high-level meeting on Friday with the country’s largest banking groups, including Mitsubishi UFJ Financial Group, Sumitomo Mitsui Financial Group, and Mizuho Financial Group.

The gathering will also include the Bank of Japan and the Tokyo Stock Exchange, reflecting the breadth of concern across the financial system.

Satsuki Katayama said the aim was to bring together key stakeholders to assess the evolving situation.

"We will bring together the core members who bear the greatest responsibility to share assessments of the current situation and exchange views, including issues that have been flagged in various parts of the international financial community," she said.

Central banks globally on alert

Regulators in other regions are taking similar steps.

The Reserve Bank of Australia on Wednesday said it was closely monitoring developments and "engaging with peer regulators, government and regulated entities."

Meanwhile, the Reserve Bank of New Zealand on Wednesday described the risks as “developing” and confirmed it was coordinating with domestic and Australian counterparts.

India has also joined the global effort.

According to a Reuters report, the Reserve Bank of India is in discussions with international regulators, lenders, and government officials to evaluate potential threats.

Preliminary assessments suggest the model could accelerate the discovery and exploitation of software vulnerabilities, raising cybersecurity concerns.

The issue has reached the highest levels of global policymaking.

Canadian finance minister François-Philippe Champagne told the BBC the model had been discussed at a recent International Monetary Fund meeting in Washington.

"Certainly it is serious enough to warrant the attention of all the finance ministers," he said, describing the technology as an "unknown unknown".

Similarly, Bank of England chief Andrew Bailey warned that authorities are closely evaluating the implications.

“We are having to look very carefully now at what this latest AI development could mean for the risk of cyber crime,” he told the BBC.

A double-edged sword for cybersecurity

Although Mythos was designed for defensive cybersecurity applications, its capabilities have sparked alarm.

Anthropic said early testing revealed “thousands” of significant vulnerabilities across major operating systems and web browsers.

On Tuesday, Bundesbank President Joachim Nagel described the model as a “double-edged sword.”

"It could be used not only to improve digital security systems, but also to leverage their vulnerabilities for malicious purposes."

Experts say the concern lies in the speed and scale at which such an AI system can identify and exploit weaknesses—far outpacing traditional security responses.

Why has Anthropic restricted access to the model?

Anthropic has restricted access to the model through a controlled initiative called Project Glasswing.

Select organisations, including Amazon, Microsoft, Nvidia, and Apple, have been granted early access, alongside dozens of entities responsible for maintaining critical digital infrastructure.

In a launch video, Dario Amodei said the company had offered to collaborate with US authorities to “help defend against the risk of these models.”

Testing by independent researchers, including so-called “red teams,” has highlighted the model’s advanced capabilities.

According to Anthropic, Mythos can autonomously identify critical bugs in legacy systems and even suggest methods to exploit them.

"Mythos Preview has already found thousands of high-severity vulnerabilities, including some in every major operating system and web browser," the company said.

"Given the rate of AI progress, it will not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely."

Risks highest in legacy systems

The potential threat is particularly acute in sectors that rely on complex and ageing infrastructure.

A report by Bain & Company noted that industries such as energy, manufacturing, and transportation could face heightened risks due to outdated systems that are difficult to patch.

Banks, too, are vulnerable given their reliance on interconnected systems, some of which date back decades.

However, the report emphasised that the risks are manageable with strong cybersecurity practices.

"The threat is serious, but it is not insurmountable, and strong cybersecurity foundations are your best defense," it said, adding that existing safeguards such as network segmentation, access controls, and anomaly detection can provide significant protection.

Focus shifts to preparedness over panic

Rather than rushing to develop entirely new AI-specific defences, experts argue that organisations should prioritise strengthening existing security frameworks.

Recommendations include setting up dedicated AI threat response teams, improving baseline cybersecurity measures, and addressing vulnerabilities in operational technology environments.

As access to powerful AI systems expands, regulators and companies alike face a balancing act—leveraging the benefits of innovation while guarding against unintended consequences.

The rapid global response to Mythos suggests that policymakers are keenly aware of the stakes.

Whether these early efforts will be enough to mitigate the risks posed by next-generation AI remains an open question.