ECB Mandates Banks Prepare Cyberthreat Defense Plans Against AI Models Like Claude Mythos

The European Central Bank (ECB), which acts as the banking regulator for the eurozone, has required banks to prepare plans to counter growing cybersecurity threats from advanced AI models such as Claude Mythos from Anthropic PBC, according to Bloomberg.

What threats does the regulator see

Advanced language models are becoming increasingly powerful in tasks that can also be misused: finding code vulnerabilities, automating phishing and social engineering, generating convincing fake messages and voice recordings for fraud. The ECB is concerned that current banking cybersecurity systems are not designed to withstand attacks amplified by such models, and requires credit institutions to develop countermeasures in advance. This is not a theoretical risk: the banking sector has already seen a growing number of fraud attempts in recent years using synthesized voice and video recordings that impersonate employees or company executives, and as model capabilities grow, it becomes harder to distinguish such attacks from genuine requests.

• The requirement comes from the ECB — the banking regulator of the eurozone
• As an example of an advanced model, the regulator cites Claude Mythos from Anthropic PBC
• Banks are required to prepare their own plans to counter AI-related cybersecurity threats

Who exactly is affected by the requirement

The ECB directly oversees the largest and systemically important banks of the eurozone under a single supervisory mechanism — these institutions will be the first to receive a request to submit defense plans. For banks of this scale, cybersecurity resilience is already one of the key priorities in regulatory inspections, but including threats from specific advanced AI models in the list of risks represents a new and more concrete level of requirements compared to the general provisions on "cybersecurity" in previous directives.

How this fits into AI regulation in Europe

The ECB requirement supplements existing EU mechanisms for controlling digital risks in the financial sector, including the Digital Operational Resilience Act (DORA), which requires banks to regularly test the security of their IT systems, and the AI Act, which introduces enhanced oversight of high-risk artificial intelligence applications. The new initiative adds a separate layer of requirements, focused specifically on threats created by advanced models themselves, rather than only on their use by banks for defense.

What this means

European regulators increasingly view advanced AI models not just as a tool that banks can use for protection, but as an independent source of systemic risk for the financial industry — and as the capabilities of such models grow, the number of similar sectoral requirements will likely increase.