Canadian regulators issued a letter warning the banking industry: advanced AI models such as Mythos may pose cybersecurity risks

The Zhitong Finance App learned that in an email sent in April, the Bank of Canada's regulators warned banks in the country that Anthropic's Claude Mythos and other advanced artificial intelligence (AI) models could pose risks. The agency said the new technology could exacerbate cyber threats and shorten the time for financial institutions to identify and fix vulnerabilities.

Global regulators are trying to assess the cybersecurity risks posed by cutting-edge AI models such as Mythos. Cybersecurity experts say Mythos is an AI model that is extremely capable of finding and exploiting cybersecurity vulnerabilities, posing a major challenge to the banking industry and its traditional technology systems.

The Canadian Financial Institutions Supervisory Office (OSFI) stated in an email: “Advanced AI models such as Claude Mythos, a subsidiary of Anthropic, have significantly reduced the time window for effective risk response.”

On Monday, the agency told the media: “OSFI takes a technology-neutral, risk-oriented approach to emerging technologies, including advanced AI models such as Mythos. Our focus is not on the technology itself, but on how federally regulated financial institutions manage and control the risks associated with their use.”

Bank of Canada executives met with regulators in early April to discuss a range of risks posed by Mythos. Earlier, US Treasury Secretary Scott Besson and then-Federal Reserve Chairman Jerome Powell called an emergency meeting of bank executives to warn of the cyber risks posed by Anthropic's latest AI model.

According to reports, three of Canada's six largest banks — Royal Bank of Canada, Toronto-Dominion Bank, and Bank of Montreal, have developed plans to earn millions of dollars through AI investments, as these banks are shifting from experimental AI projects to applying AI to chatbots, internal tool development, and reducing reliance on third-party tools.

Additionally, Scotiabank, Canadian Imperial Bank of Commerce, and the National Bank of Canada have also announced a number of AI plans.

The Canadian government said it has obtained Anthropic's Project Glasswing project permission, which enables businesses to access the Mythos system. It is currently unclear which banks in Canada are participating in the project. The Canadian Bankers Association said that banks have invested heavily in protecting the financial system and are strictly complying with OSFI's high standards for cybersecurity risk management and incident reporting.

Bruce Ross, head of the Royal Bank of Canada's AI department, said in June that Mythos highlights changes in the cyber attack situation, making it necessary for organizations to respond quickly, because once a new vulnerability is discovered, attack methods may immediately appear.

“The industry's current approach is to build its own AI defense system... we will continue to do so,” he said.