Latest AI models could threaten world banking system, financial officials warn

Senior international financial officials have warned the latest AI models from US tech companies could threaten the world banking system by exposing weaknesses in lenders’ cyber defence.

As finance ministers, central bankers and regulators met this week in Washington for the IMF and World Bank spring meetings, their discussions were dominated by concern over the latest AI model developed by San Francisco-based start-up Anthropic.

“It is a very serious challenge for all of us,” said Andrew Bailey, governor of the Bank of England, who chairs the Financial Stability Board of global regulators. “It reminds us how fast the AI world moves.”

Bailey added that global regulators would need to rapidly evaluate the potential cyber security threat to the financial system from Anthropic’s new Claude Mythos Preview model.

Until just over a week ago, most policymakers had expected the IMF and World Bank meetings to focus on the conflict in the Middle East, tensions in the private credit market and elevated levels of government debt.

Instead, the ability of new AI models to wreak havoc in the world’s banking system was all many people wanted to talk about.

“The evolution of digital technology is posing immense risks from a cyber security perspective,” said Dan Katz, deputy head of the IMF and former chief of staff for US Treasury secretary Scott Bessent. “This is really going to be absolutely essential on the international agenda for the next few months.”

European Central Bank president Christine Lagarde said: “The development we’ve seen with Anthropic and Mythos is a good example of a responsible company that is suddenly thinking, ‘ah, that could be really good’ — but if it falls in the wrong hands, it could be really bad.”

Some officials called for a co-ordinated international response to the threat from Mythos, which Anthropic said earlier this month had “found thousands of high-severity vulnerabilities, including some in every major operating system and web browser”.

The company warned it would “not be long before such capabilities proliferate, potentially beyond actors who are committed to deploying them safely”. It added: “The fallout — for economies, public safety and national security — could be severe.”

“Everybody is keen to have a framework within which to operate,” Lagarde told Bloomberg TV. But she added: “I don’t think there is a governance framework that is there to actually mind those things. We need to work on that.”

So far, Anthropic has only shared Mythos with a group of about 40 companies, including Amazon, Apple and JPMorgan Chase, giving them a chance to experiment with it and start fixing any vulnerabilities it finds in their systems.

Bessent last week convened leaders of some of the largest Wall Street banks and Jay Powell, the chair of the Federal Reserve, to discuss the weaknesses revealed by Mythoswhich some US authorities are believed to have access to.

Officials in Washington said the technology represented a fundamental change in the playing field between attackers and defenders of information systems because of its ability to autonomously string together multiple software vulnerabilities at a scale beyond human capacity.

They have been both impressed and alarmed by Mythos’s ability to decide autonomously how to approach problems, but are worried about the lack of regulation for AI companies. The officials say they are looking at collaborating with tech companies, including Anthropic.

However, some European regulators and executives say they have been left in the dark about the potential vulnerabilities revealed by the latest AI technology as most of them have not been able to test the new model and determine the level of threat it could pose.

When asked how the European Banking Authority was responding to concerns around Mythos, François-Louis Michaud, its new head, said: “It is a process that is starting and we are now contemplating what is the right answer.”

Michaud and other European regulators said that for several years they have been focused on cyber security threats to the banking system, which intensified after Russia’s full-scale invasion of Ukraine in 2022, including assessing the new potential risks from quantum computing.

Michaud pointed out the EBA had been hiring more cyber security specialists after being given the power to supervise key IT suppliers to EU banks. “I am not saying everything is fine and perfect but I am saying we are not starting from scratch,” he said.

Senior Europe-based executives at a big bank and at a large financial infrastructure group told the FT on the sidelines of meetings in Washington that they had not yet had a chance to test Mythos.

The banking executive said: “If what they say is true then it is obviously serious. But it is too early to know. We are speaking to Anthropic to get a look at this model.”

OpenAI, the maker of ChatGPT, announced on Thursday that it was sharing its latest model specifically designed for cyber security with a limited number of “vetted security vendors, organisations and researchers” for testing. It said the new model, GPT-5.4-Cyberwas “purposely fine-tuned for additional cyber capabilities and with fewer capability restrictions”.

Chief executives of large US banks confirmed this week that they were working with a beta version of Anthropic’s Mythos model. JPMorgan chief executive Jamie Dimon said the new AI model “shows a lot of vulnerabilities that need to be fixed”.

But executives also played up the productivity gains they were anticipating from AI. “AI is our friend. It is just the latest generation of technology that is going to be part of the ecosystem,” said Morgan Stanley boss Ted Pick. “We’re working with Claude Mythos, the beta version, and we are looking at different places inside of infrastructure where we will just [see] continuous improvement.”

Robin Vince, chief executive of BNY, the oldest US bank, told the FT it was also testing Anthropic’s model, while Citigroup chief financial officer Gonzalo Luchetti told reporters on Tuesday that the bank was approaching the technological breakthrough with the “degree of urgency that it requires”.

Some regulators are sceptical that there will be a co-ordinated global response to the threat of AI given current geopolitical tensions, which are being exacerbated by the Middle East conflict.

Policymakers are also reluctant to hamper the development of a technology that could bring big economic benefits.

“What is the optimum moment to frame the rules of the road?” Bailey asked. “If you go too early you a) risk missing the target and b) you risk distorting the evolution, and if you go too late things can get out of control.”