UK Regulators Assess Anthropic Claude Mythos Cyber Risks

British financial regulators, led by the Bank of England, Financial Conduct Authority and UK Treasury, are conducting urgent talks with the National Cyber Security Centre and representatives from major banks, insurers and exchanges to assess cyber risks introduced by Anthropic's Claude Mythos Preview. Regulators expect to brief the financial sector within the next fortnight following Anthropic's disclosure that the model has flagged thousands of critical vulnerabilities. The matter has drawn parallel attention in the United States, where US Treasury Secretary Scott Bessent convened a meeting with major Wall Street banks on the model's potential cyber risk.

Claude Mythos Preview is being used under a controlled program identified as Project Glasswing, which permits select organizations to access the unreleased model for defensive security research. Anthropic reports the model has found large numbers of software weaknesses across operating systems, web browsers and other widely deployed stacks. Key practical points for practitioners:

• •Claude Mythos Preview is positioned as a defensive tool, not a public release, and access is limited under Project Glasswing.
• •The model's vulnerability discovery raises questions about reproducibility, false positive rates, and the risk of exposing exploit-ready findings to adversaries.
• •Regulatory engagement targets operational dependencies in critical financial infrastructure, not just research implications.

This is a convergence of model capability and systemic risk. Models that can surface zero days or attack paths create dual-use dynamics: they accelerate defensive patching while also increasing the information available to threat actors if not handled securely. Financial systems are high-value targets with complex legacy stacks, so regulator focus is rational. Cross-jurisdiction coordination, shown by simultaneous UK and US activity, signals that financial regulators view advanced LLM-driven vulnerability discovery as a material cyber risk rather than a purely academic advance.

Expect short-term sector briefings and guidance from regulators on handling AI-derived vulnerability intelligence, plus pressure on vendors and model operators to demonstrate secure controls, disclosure protocols and provenance for flagged issues. Follow-up actions could include mandated reporting, constrained access policies for high-risk model outputs, or specific defensive tooling requirements.