ECB Urges Banks to Accelerate Cyber Defenses Against AI Risks

ECB Executive Board member and Supervisory Board vice-chair Frank Elderson told the Financial Times that the ECB summoned major eurozone banks, of which it supervises about 111, to an urgent meeting in late May 2026 to accelerate cybersecurity work already underway. "There is a whole range of issues on cyber security that we have been engaging on with the banks for years which are all still valid, but given the progress in AI, they need to be dealt with faster," Elderson said, according to the Financial Times, as reported by The Next Web and FStech. He said AI models can now reverse-engineer a software vendor's patch and produce a working exploit within minutes of release: "It seems if one of the big software providers comes with a patch it is possible to reverse-engineer the vulnerability that the patch is supposed to patch, not in weeks but maybe in 30 minutes." Elderson called the shift "game-changing" and said "the clock is ticking." The trigger is Anthropic's Claude Mythos Preview, which the company has said identified "thousands of high-severity vulnerabilities" across major operating systems and browsers, with a first-attempt exploit success rate above 83% in controlled testing, according to reporting on the model.

Access to Mythos is restricted to roughly 40 to 50 organizations through Anthropic's Project Glasswing testing program, including Amazon, Microsoft, Google, Nvidia, CrowdStrike, Palo Alto Networks, and JPMorgan Chase, per The Next Web; no European bank is on that list. The ECB is asking the US banks with access to share their findings with European counterparts. Elderson called the access gap "unfortunate" but said it is "not an excuse for inaction," warning that "malicious actors might have access to this technology soon" (Anthropic has estimated adversaries could replicate the capability within six to twelve months). The concern extends beyond the ECB: Anthropic has briefed the Financial Stability Board, at the request of Bank of England governor Andrew Bailey, who chairs it, and the Federal Reserve and US Treasury separately convened bank CEOs on the same risk. Separately, French AI startup Mistral AI is in talks with European banks, including HSBC and BNP Paribas, about a rival vulnerability-hunting model, framing it as a matter of technological sovereignty.

For bank security and compliance teams, the practical takeaway is that patch-and-defend timelines built around weeks or days no longer hold when adversaries, or defenders, can wield AI-assisted reverse engineering; the EU's Digital Operational Resilience Act (DORA), which requires banks to manage IT risk, test resilience, and report incidents, is the regulatory lever the ECB is expected to lean on. Expect near-term demand for automated patch orchestration, faster incident-response pipelines, and closer scrutiny of third-party and vendor risk, regardless of whether a given bank has access to Mythos-class tooling.

• •Whether the EU reaches an access agreement with Anthropic for banks and regulators to test against Mythos-class vulnerabilities directly; talks with the European Commission were reported stalled as of mid-May.
• •Formal ECB supervisory guidance or DORA-linked expectations referencing AI-driven cyber risk.
• •Progress on Mistral AI's rival cybersecurity model and whether European banks adopt it as an alternative access point.
• •Further disclosures from Palo Alto Networks and others on the pace of AI-discovered vulnerabilities industry-wide.