European Central Bank gives banks four months to prepare for AI cyber attacks threat

Top banking watchdogs issue stark warning over AI-driven cyber attacks

Europe's top banking watchdogs have warned that frontier AI models such as Anthropic's Mythos pose "systemic risks to the financial system" as they gave lenders a tight four-month deadline to prepare for cyber security threats. The Eurozone's chief banking supervisor Claudia Buch on Tuesday sent a letter to 110 lenders giving them until the end of October to come up with a "comprehensive action plan" to combat the cyber risks posed by state of the art AI models. These should include "concrete measures to strengthen relevant controls, allocating the necessary resources, assigning clear roles and responsibilities, and defining timelines for implementation", said Buch, who is chair of the European Central Bank's supervisory board. In a separate warning issued on Tuesday, the European Systemic Risk Board said modern AI models can undermine financial stability across the Eurozone. The ESRB, which is responsible for monitoring and preventing dangers to the region's financial system, said the latest technology can discover and exploit bugs "at a speed, scale and level of accuracy far exceeding previous AI models". They represent "a paradigm shift for cyber security" as IT weaknesses could now be "weaponised" in a "matter of minutes or hours", it said. The watchdogs did not name Mythos in their warnings but referred to "frontier artificial intelligence models" in general. As a consequence, the bodies are urging banks to rapidly beef up their IT security capabilities. Over the short term, lenders need to be in a position to detect and fend off large-scale attacks quickly and to ensure that their third-party IT service providers are also able to do so, Buch stressed in her letter. Over the medium term, lenders also need to improve their "cyber hygiene", she added. In an attempt to compensate for the tight timeline, the ECB is postponing the deadline for its annual IT risk questionnaire, which banks now have until February to file rather than September. "Potential adjustments to other supervisory activities, such as on-site inspections or deep dives, will be considered on a case-by-case basis," Buch said in her letter.

ECB tells banks to draw up plans against AI attacks amid disruption fears

FRANKFURT, July 7 (Reuters) - The European Central Bank on Tuesday gave euro zone banks four months to draw up plans to counter AI-enabled cyber threats that could undermine confidence in the financial system and disrupt payments. The move reflects mounting concern among regulators about advanced AI models such as Anthropic's Mythos whose cyber capabilities have become so powerful that access to some of them has been restricted -- a limitation that currently excludes euro zone banks. "These developments have potentially profound implications for the confidentiality, integrity and resilience of banks' information ⁠and communication technology (ICT) systems," the ECB said in a letter to bank chief executives. It told banks to prioritise protecting internet-facing systems and other exposed technology assets, including third-party software and open-source components, while speeding up vulnerability fixes and strengthening monitoring. The euro zone's top banking supervisor also urged lenders to modernise ageing technology, improve cyber hygiene and strengthen crisis-management, recovery and information-sharing arrangements. Banks have until October 31 to submit their plans. To free up resources, the ECB has postponed a ⁠separate IT survey and may adjust inspections and other supervisory work. In a warning published alongside the ECB's letter, the European Systemic Risk Board said large-scale cyber disruptions could erode trust in financial institutions and even trigger runs on companies or countries perceived ⁠as less secure. "The ESRB considers these developments to be a source of systemic risks to the financial system," said the ESRB, a European Union body that issues recommendations ⁠to other authorities. To illustrate the risks, the ESRB outlined scenarios ranging from a gradual loss of confidence in smaller banks to state-backed espionage and coordinated ⁠attacks on payments, clearing and settlement systems, potentially amplified by misinformation campaigns. It said incidents could spread quickly through common technology providers and shared software used across the financial sector. Reporting by Francesco Canepa. Editing by Mark Potter Our Standards: The Thomson Reuters Trust Principles., opens new tab