ECB Questions Banks on Risks from Anthropic's Mythos

The European Central Bank is gathering information and will question banks about potential cyber risks arising from Anthropic's new AI model, Mythos. ECB supervisors will use their routine supervisory dialogue to probe bank preparedness rather than convene a special meeting with top executives. The move follows industry warnings that Claude Mythos Preview can generate high-level code and identify system vulnerabilities, elevating cyberattack risk for financial institutions.

Anthropic has restricted broad access to Claude Mythos Preview and launched Project Glasswing to coordinate private testing with selected partners. Key practical points for practitioners:

• •Participants invited to Project Glasswing include major tech companies, cybersecurity vendors, JPMorgan Chase, and several dozen other organizations
• •The core concern is Mythos's ability to produce exploit code, reconnaissance scripts, and high-level attack plans by synthesizing system-specific prompts and code templates
• •Regulators are focused less on model architecture and more on operational exposures: legacy system patching, automated incident-response tooling, vendor risk, and detection blind spots

This is a clear escalation in regulatory attention to frontier models that can automate cyber offense techniques. The ECB action mirrors engagements by U.S. authorities; U.S. Treasury and Federal Reserve officials have recently convened bank leaders to discuss AI-related cyber risk, and national security and technology ministries in the U.K. have issued warnings. Anthropic's containment approach, using invitation-only testing and Project Glasswing, acknowledges the asymmetric risk of releasing powerful code-generation models into the wild. For banks, the episode highlights persistent vulnerabilities from legacy stacks and the need to treat advanced generative models as a new threat vector rather than only a productivity tool.

Expect supervisory questionnaires probing patch management, incident response, red-team capabilities, vendor controls, and threat-hunting readiness. Private-sector participation in Project Glasswing and regulator-industry dialogues will shape guardrails for access controls, disclosure norms, and potential restrictions on model features that demonstrably enable exploitation.