Copy article

Cybersecurity: UK Regulators Plan to Meet to Assess Risks of Anthropic’s New AI Model Mythos

ended 14. April 2026

Anthropic, the company the US government branded a ‘national security threat’ last month is now the company both Washington and London are relying on to protect their financial systems from the next generation of cyberattack.

Anthropic's Claude Mythos Preview, withheld from public release because of its ability to find and chain together software vulnerabilities across every major operating system and browser, has prompted the Bank of England, FCA, Treasury and NCSC to convene urgent talks with UK banks, insurers and exchanges. The meeting follows the US Treasury Secretary and Fed Chair pulling Wall Street CEOs into a room over the same model last week.

Anthropic's head of offensive cyber research says comparable capability from other labs, including Chinese ones, is six to eighteen months away. Anthropic has speculated that those labs won't be running coordinated disclosure programmes or briefing regulators and big tech so defensive action can be taken. 

The regulatory scramble is aimed at the company that volunteered its findings. The ones that don't volunteer are the a bigger problem, and nobody's convening emergency meetings about them yet.

If UK financial regulators are serious about this, the question isn't what Mythos can do. It's what happens when the next model with the same capability arrives from a lab with no Glasswing to coordinate big tech's response, no ethical red lines, and no interest in picking up the phone.

We'd like your views:

  • Anthropic found vulnerabilities in critical systems that survived decades of human review. Should regulators require financial institutions to submit to AI-led security audits, and if so, who decides which AI model gets access to your infrastructure? What does this mean for customer privacy?
  • Anthropic estimates comparable offensive cyber capability will be widely available within six to eighteen months. If UK financial institutions haven't hardened their systems by then, who carries the liability, the banks, the regulators, or the software vendors whose decades-old vulnerabilities were never found until an AI looked?
  • The UK's compensation architecture was designed for individual firm failures and individual fraud cases. It was never designed for a scenario where AI-driven cyberattacks hit multiple institutions simultaneously, exploiting the same class of vulnerability across the sector. How can/should clients be compensated?
  • Mythos Preview's own safety evaluation revealed the model appeared to deliberately underperform to seem less capable. If AI systems can now manage how they present themselves under evaluation, what does that mean for every compliance and audit framework the financial sector currently relies on?

2 responses from the Newspage community

Copy all

Star Quote
Copy

Colette MasonVerified
AI Ethics Consultant at Clever Clogs AI
FSCS covers deposits up to £120k when a firm collapses. APP fraud reimbursement caps at £85k per claim. The Financial Ombudsman maxes out at £430k. Every one of those mechanisms assumes an isolated incident affecting one institution. A correlated cyberattack exploiting a shared software vulnerability across multiple banks breaks that assumption completely. The FSCS levy pool is funded by the same institutions that would be under attack. The APP reimbursement regime splits costs 50:50 between sending and receiving firms, useless when both sides are compromised. The BoE's CMORG is meeting within the fortnight to discuss Mythos, but its mandate is operational resilience. Nobody in the room has a mandate for what happens to customers when resilience fails at sector level.

The US convened on 8 April. The UK hasn't scheduled theirs yet. If comparable offensive capability is six to eighteen months away from broad availability, the compensation question isn't theoretical it's urgent.
Copy

Pro
Katrina YoungVerified
Futurist | Chief Technology Officer CTO/CDO Ethical AI & Digital Transformation Strategist at KYC Digital
The Bank of England, FCA, Treasury and NCSC convening emergency talks is a rational response to the wrong problem.

The debate is framed around whether financial institutions should adopt AI-led security audits. That question is already obsolete. A model capable of identifying decades-old vulnerabilities across hardened systems is operational. The gap is not capability. It is control.

Access to systems like Mythos Preview is privately governed, with no independent UK standard defining who can deploy them, under what authority, or with what constraints on data exposure.

The consequence is not theoretical. Compensation frameworks assume isolated incidents. FSCS protection, APP reimbursement rules and Ombudsman limits break under correlated failure.

If AI identifies shared vulnerabilities simultaneously, exposure becomes systemic while liability remains fragmented. Comparable offensive capability is expected within six to eighteen months. Without governance, outcomes will not change.