Bank of England governor urges swift assessment of cyber risks to banks from Anthropic's AI model

Bank of England Governor Andrew Bailey has urged regulators worldwide to quickly assess the threat that Anthropic's Mythos AI model may pose to banks. The statement matters not only because it names a specific company and model. It shows that the debate over artificial intelligence in the financial sector is shifting from efficiency and automation to cyber resilience and systemic risk. For central banks and supervisors, what counts now is not only AI's potential, but also how fast it can change the threat profile for the largest financial institutions.

Bailey heads one of the world's key central banks, and his public warnings are usually read as a signal to the wider regulatory community. On cyber risk, the concern is not an abstract "rise of the machines" but more down-to-earth scenarios: faster phishing attacks, automated discovery of vulnerabilities, generation of malicious code, circumvention of internal procedures, and cheaper sophisticated attacks for malicious actors. Banks are especially sensitive to such changes because they manage money, critical payment infrastructure and huge volumes of confidential data at the same time.

It also matters that Bailey is talking specifically about a global regulatory response. Large banks operate in several jurisdictions at once, rely on international cloud services, connect to shared payment channels and use long chains of external technology suppliers. If a powerful AI system lowers the barrier to entry for cyberattacks or speeds up the preparation of complex operations, the problem does not stay local. A weak link in one country or at one contractor can quickly become a problem for cross-border financial flows. So the call for a quick assessment reads as a call for coordination, not just for one more internal report.

The mention of Mythos is telling too. Regulators often discuss AI as a class of technology, but less often publicly point to a specific model that requires an urgent risk assessment. That means the focus is gradually shifting from general principles to practical analysis of a product's capabilities: how autonomously it can carry out chains of actions, how well it handles technical tasks, whether it can use external tools, how much it makes potential abuse scalable, and how quickly its capabilities improve from version to version. This approach is not the same as accusing the developer of building a dangerous tool. It is rather an acknowledgment that model capabilities themselves are becoming a subject of financial supervision.

For banks, such signals mean that formal cyber hygiene alone is no longer enough. They will likely have to take a fresh look at access control, how employees use external AI services, contractor vetting, fraud-scenario testing, protection of internal code repositories and the quality of monitoring for unusual activity. AI complicates the picture because the same technologies can strengthen both defense and attack. Systems that help analysts spot anomalies faster and automate investigations could potentially also speed up the preparation of more precise and larger-scale attacks. As a result, the old model of infrequent checks and slow updates to requirements looks increasingly inadequate.

Bailey's statement can be read as an early marker of a new stage of regulation: AI in finance is now viewed not only through the lens of innovation, but also through that of operational resilience. If regulators worldwide really do speed up such assessments, banks will most likely face tougher requirements for testing, disclosure and management of external technology dependencies. If not, the advantage in speed may end up with the attackers. The main question is not whether the financial sector needs AI, but whether rules and defenses are keeping pace with the development of the models themselves.