UK Regulators Rush to Assess Risks of Anthropic's AI Model, US Regulators Concerned

Financial regulators in the UK are racing to assess the systemic risks posed by Anthropic's latest AI model, nicknamed "Mythos," after it demonstrated the ability to identify thousands of zero-day vulnerabilities — many of them critical — in widely deployed financial infrastructure. The news has triggered emergency consultations involving the Bank of England, FCA, Treasury, and the National Cyber Security Centre (NCSC), with urgent briefings scheduled with representatives from major British banks, insurers, and exchanges within the next fortnight . Regulators are specifically focused on whether the model's vulnerability-discovery capabilities could be misused or accessed by adversarial actors if deployment controls fail.

US regulators moved in parallel. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened a meeting with Wall Street bank CEOs on April 10 to issue quiet warnings about potential cyber risks stemming from the Mythos capabilities. The concern is not that Anthropic itself poses a threat, but that the model's capabilities — even in a controlled defensive preview — have materially changed the threat landscape by making large-scale vulnerability scanning far more accessible.

Anthropic had made Mythos available as a limited preview to just 12 partner organizations, explicitly restricted to defensive security work under its Project Glasswing initiative. Canada followed the UK and US with its own regulatory assessment. The episode marks a pivotal moment in AI governance: for the first time, a foundation model's security research capabilities have prompted coordinated, multi-jurisdictional regulatory engagement across the financial sector rather than the traditional technology sector.