Banks face dual AI risk as Mythos exposes vulnerabilities while fraud attacks surge globally

Banks Confront Unprecedented AI Risk From Mythos Model

The global banking sector faces a critical moment as Anthropic's latest AI model, Mythos, reveals thousands of severe security vulnerabilities that have remained hidden for decades 1

1

. Internal testing uncovered what cybersecurity experts call zero-day vulnerabilities—flaws so dangerous they require immediate fixes across every major operating system and web browser. The model's capabilities are so advanced that Anthropic has restricted public access, making it available only to a defensive coalition including Microsoft, Amazon Web Services, Apple, Cisco, and the Linux Foundation, along with more than 40 additional organizations including several US banks 1

1

.

Switzerland's top financial regulator Finma issued a stark warning about the systemic bank risk posed by unrestricted access to AI models like Mythos. "The uncontrolled and immediate availability of AI models suchs as Mythos would be classified as a systemic risk," a Finma spokesperson stated, noting that "virtually all existing software systems could simultaneously be affected by a multitude of previously unknown zero-day vulnerabilities, which would be exploited immediately and via AI" 2

2

. This concern reflects the broader anxiety among financial regulators worldwide about the cybersecurity threat emerging from advanced AI capabilities.

Financial Regulators Scramble to Address AI-Exploited Vulnerabilities

The European Central Bank convened emergency discussions with chief risk officers of eurozone lenders to assess potential threats from Mythos 2

2

. Bundesbank President Joachim Nagel emphasized the delicate balance required: "We must prevent the misuse of this technology. At the same time, all relevant institutions should have access to such technology to avoid competitive distortions" 2

2

. Commerzbank AG confirmed it is examining the Mythos model closely while maintaining contact with other banks, technology partners, and regulatory authorities.

Anthropic has committed $100 million in usage credits and $4 million in open-source grants to help find and fix the vulnerabilities discovered by Mythos 1

1

. However, concerns intensified when Bloomberg reported that a small group of unauthorized users may have gained access to the model, though Anthropic stated there was no evidence of malicious intent 1

1

. The incident underscores the challenge of containing powerful AI tools in an interconnected digital ecosystem.

Legacy Systems Amplify AI-Driven Threat Landscape Vulnerability

Banks present particularly attractive targets for cyber attacks on financial services because the industry runs on legacy systems—decades-old technology that may be especially vulnerable to AI-exploited vulnerabilities 1

1

. According to IBM's X-Force 2025 Threat Intelligence Index, the finance and insurance sectors accounted for 27 per cent of all incidents in 2025, the second highest share across all industries 3

3

. Patrick Opet, chief information security officer at JPMorgan Chase, noted that "more is changing now and faster than we have seen in a long time, the time to find and exploit vulnerabilities is drastically decreasing" 3

3

.

The rapid adoption of AI in banking has created what IBM's Shanker Ramamurthy describes as "innovation asymmetry"—banks must operate within frameworks of regulation and ethics while criminals leverage AI unencumbered, "accelerating the threat landscape at an exponential rate" 4

4

. This asymmetry puts financial institutions in a cybersecurity arms race where defense proves far more difficult than attack, as software complexity makes bug-free systems nearly impossible to guarantee 1

1

.

AI-Powered Fraud Emerges as Parallel Threat

While Mythos dominates regulatory attention, experts warn that AI-powered fraud represents an equally dangerous but more immediate threat already operating at industrial scale. Research commissioned by Kroll found that 76 per cent of organizations have experienced a security incident involving AI applications or models in the past two years 3

3

. UK industry body Cifas reported that AI scams pushed fraud reports to a record 444,000 last year, with identity fraud in banking rising 10 per cent year-on-year to 63,678 cases as deepfakes and AI-powered social engineering make fraud more difficult to detect 4

4

.

Unlike cyber attacks that breach systems, AI-powered fraud bypasses security by targeting people directly. "AI systems can generate thousands of convincing messages, voices and videos in seconds, each tailored to a specific individual," creating authorised transactions that existing safeguards struggle to prevent 5

5

. Nick Calver, vice-president for financial services at Palo Alto Networks, described receiving a perfectly crafted phishing email that only raised suspicion due to the sender's email address, noting "it's making threats more real and it's only going to get more threatening" 3

3

.

Financial Institutions Deploy Defence AI and Enhanced Risk Management

Major banks are implementing comprehensive strategies to address the AI-driven threat landscape. JPMorgan Chase sent letters to suppliers in 2025 warning that failure to improve cybersecurity practices would result in lost business, while probing suppliers on their defensive capabilities to identify weaknesses in infrastructure 3

3

. Lloyds Banking Group developed its Global Correlation Engine, an AI tool that helps identify threats and reduce false positives—activity misidentified as malicious 3

3

. HSBC appointed its first chief AI officer, David Rice, despite cost-cutting measures that include reducing headcount and cutting $1.5 billion by year-end 4

4

.

Finma emphasized that banks "must actively incorporate the evolving threat landscape into their risk management," noting that "cyber attacks are becoming faster, more precise, and easier to carry out with the help of AI" 2

2

. Experts advocate for Defence AI approaches—using AI to defend against AI-driven threats—as human-only defenses cannot scale to match machine-speed attacks 5

5

. This requires architectural redesign with real-time, AI-native detection and integration of fraud, anti-money laundering, and behavioral signals to enable intervention at the point of transaction.

What This Means for Cyber Resilience Going Forward

The Mythos situation exposes fundamental challenges in maintaining cyber resilience as AI capabilities advance. Treasury Secretary Scott Bessent and Federal Reserve Chair Jay Powell's recent meeting with bank CEOs signals that AI risk is now understood as a material threat to core financial infrastructure 5

5

. However, the focus on cyber vulnerabilities, while justified, may overlook the parallel threat of AI-powered social engineering that operates as "a continuous and distributed leakage of funds across millions of transactions" 5

5

.

Bank customers face minimal direct risk due to deposit insurance schemes and fraud reimbursement policies, but should maintain vigilance by regularly updating operating systems and banking apps as new vulnerabilities are discovered and patched 1

1

. The trajectory points toward potential trillions of dollars in losses if the financial system fails to respond with sufficient urgency to both the cybersecurity threat posed by models like Mythos and the escalating wave of AI-powered fraud 5

5

. As one expert noted, if the public loses confidence that financial institutions can protect against manipulation and fraud, trust erosion may prove no less damaging than direct cyber attacks.