Singapore's Regulator Orders Banks to Close Security Gaps Amid Concerns Over Anthropic's Mythos

The Monetary Authority of Singapore (MAS) has issued a formal warning to banks: institutions must urgently fix existing vulnerabilities in their cybersecurity systems. The regulator's call comes amid growing unease in Asian financial circles over Mythos, a new language model from the US company Anthropic.

Mythos is the latest release from Anthropic, the maker of the Claude family of models. According to Bloomberg, it is the model's ability to understand context and generate convincing text that has raised concrete concerns among information security specialists in the financial sector. The worry is not about the model itself, but about its potential use by attackers: to craft phishing emails, imitate bank communications and run automated attacks on the customers and employees of financial organizations.

Singapore has long held a leading position among Asia's financial centers and traditionally acts proactively on technology-risk regulation. MAS is known for strict technology risk management requirements: banks must follow the regularly updated Technology Risk Management Guidelines. The current warning continues that practice: rather than reacting to incidents after they happen, the regulator is demanding preventive measures.

According to Bloomberg's sources, MAS singles out several categories of vulnerability. The first is outdated authentication systems that are insufficiently protected against attacks using synthetic voices and deepfakes, whose quality has risen sharply in recent months. The second is weak points in email protection: bank employees increasingly fall victim to sophisticated phishing scenarios that are practically impossible to recognize without special training. The third is the risk from banks' own use of third-party AI tools without proper security vetting.

Asian regulators' reaction to Mythos has been noticeably sharper than to earlier Anthropic releases. Analysts point to several factors. After a series of high-profile incidents in 2025, in which fraudsters successfully used language models to attack bank customers in Hong Kong and South Korea, regulators in the region have taken such risks far more seriously. In addition, Singapore, as Southeast Asia's largest financial hub, handles a significant volume of cross-border transactions, which makes local banks especially attractive targets.

It is important to understand that this does not mean the Mythos model itself poses a direct threat, or that Anthropic is complicit in any abuse. MAS is responding to a fundamental shift in the threat landscape: any powerful language model that becomes widely available inevitably expands the capabilities of legitimate users and attackers alike. A few years ago, a sophisticated phishing attack required a team of experienced specialists; today, ordinary access to a cutting-edge AI tool is enough.

Banks that receive the MAS directive will have to audit their cybersecurity systems and report on the measures taken. Analysts expect that the Hong Kong Monetary Authority (HKMA) and other regional regulators may issue similar warnings in the near future. The question is no longer whether Asian financial regulators will adapt their standards to the reality of powerful AI, but how quickly it will happen.