ECB orders banks to prepare defenses against cyber threats from AI models like Claude Mythos

The European Central Bank (ECB), which acts as the eurozone's banking regulator, has ordered banks to prepare plans to counter the growing cyber threat from frontier AI models such as Claude Mythos from Anthropic PBC, Bloomberg reports.

What threat does the regulator see?

Frontier language models keep getting better at tasks that can also be turned to harmful ends: finding vulnerabilities in code, automating phishing and social engineering, and generating convincing fake messages and voices for fraud. The ECB worries that banks' existing cyber defenses were not built to withstand attacks amplified by such models, and it wants lenders to work out response scenarios ahead of time. This is not a theoretical risk. In recent years, the banking sector has already seen a rise in fraud attempts that use synthesized voices and video to impersonate employees or company executives. As model capabilities grow, these attacks become harder to tell apart from genuine requests.

• The requirement comes from the ECB, the eurozone's banking regulator
• The regulator cites Claude Mythos from Anthropic PBC as an example of a frontier model
• Banks must prepare their own plans to counter AI-driven cybersecurity threats

Who exactly does the requirement cover?

Under the Single Supervisory Mechanism, the ECB directly supervises the eurozone's largest and systemically important banks, and these institutions will be the first asked to submit defense plans. For banks of this size, cyber resilience is already one of the top priorities in regulatory reviews. But adding threats from specific frontier AI models to the list of risks marks a new, more concrete level of requirements than the general "cybersecurity" language in earlier directives.

How does this fit into AI regulation in Europe?

The ECB's requirement builds on the EU's existing mechanisms for overseeing digital risk in the financial sector. These include the Digital Operational Resilience Act (DORA), which requires banks to regularly test the security of their IT systems, and the AI Act, which introduces stricter oversight of high-risk uses of artificial intelligence. The new initiative adds a separate layer of requirements focused specifically on the threats that frontier models themselves create, not only on how banks use them for beneficial purposes.

What this means

European regulators increasingly treat frontier AI models not only as a tool banks can use for defense, but also as a standalone source of systemic risk for the financial industry. As these models grow more capable, the number of such industry-specific mandates will likely increase.