ECB to discuss risks of Anthropic's Mythos model for the financial system with banks

The European Central Bank is moving the conversation about artificial intelligence out of the realm of technology experiments and into direct banking supervision. The regulator is setting up a call with chief risk officers of eurozone banks to discuss Anthropic's new Mythos model specifically and to understand whether it can exploit vulnerabilities in financial systems.

The format of the meeting matters as much as its subject. When a central bank reaches out not to IT teams or innovation units but to chief risk officers, it signals that the issue is treated as a potential threat to stability, not as one more tool for boosting efficiency. The focus then falls not on interface convenience or model performance, but on operational risks, data protection, access control, the resilience of internal processes, and the possibility that AI will speed up already known attack scenarios. No real incidents involving Mythos have been reported so far, but the very wording of the agenda shows how seriously the regulator takes the topic.

The reason for the attention is clear. Banks stopped being closed structures, with critical systems isolated from the outside world, long ago. They run complex chains of contractors, cloud services, APIs, automated monitoring systems, internal analytics tools and digital customer channels. Against that backdrop, every jump in AI capability raises a new set of questions. If a model can analyze code better, build multi-step scenarios faster, work confidently with large datasets or automate interaction with external services, then the risk of abuse grows along with the benefits. In theory, such systems could help attackers find weak configurations faster, prepare convincing phishing campaigns, scale social engineering, or probe defensive barriers faster than before.

This is a particularly sensitive subject for the European regulator, because the eurozone's financial infrastructure rests on trust in the reliability of banks, payment rails and control procedures. Even if the new model does not create a fundamentally new type of threat, it can make old threats cheaper, faster and larger in scale. That is one of the key effects of modern AI systems: they do not necessarily invent a new way to break in, but they can sharply lower the barrier to entry for complex operations.

So the discussion about Mythos probably concerns not only Anthropic's model itself, but also a broader class of systems that gain more autonomy, plan actions better and can work as a tool in the hands of a person or a team.

In practice, such calls are usually meant to compare risk maps and work out what banks should check first. The questions may include how access to internal systems is controlled, where authentication processes remain weak, how securely banks connect external models, and how quickly they would notice unusual activity if AI were used in an attack. For the banks themselves, it is also a signal to revisit their red teaming scenarios, vendor risk management procedures and requirements for AI service providers. Once a regulator raises the issue at the level of chief risk officers, the topic almost inevitably moves on to formal inspections, stress scenarios and new reporting expectations.

The main takeaway is simple: major financial regulators no longer treat advanced AI models as neutral office technology. The Anthropic Mythos case shows that the next stage of AI adoption in banks will involve not only productivity and automation, but also a hard rethink of cyber risks, internal controls and accountability for using external models. For the market this is an important turn: the stronger AI systems become, the faster they are judged by the standards of critical infrastructure rather than consumer software.