Canadian regulator warns banks of cyber risks from Anthropic's Claude Mythos
Canada's banking regulator warned major financial institutions that Anthropic's Claude Mythos AI model could accelerate cyber attacks by reducing the time available to detect and fix security flaws. The regulator issued guidance on how banks should strengthen their risk identification and response capabilities in response to the advanced AI capability.
What happened
Canada's Office of the Superintendent of Financial Institutions (OSFI) sent an email in April 2026 to chief technology officers, chief information security officers, and chief risk officers at the country's largest banks and insurance companies.
The regulator warned that advanced AI models, including Anthropic's Claude Mythos, could speed up cyber threats by reducing the time available to detect and fix security vulnerabilities. OSFI stated: 'Advanced artificial intelligence models, such as Anthropic Claude Mythos, significantly compress the timeframe for effective risk mitigation.'
Reported impact
Cybersecurity experts describe Claude Mythos as extremely capable at finding and exploiting cybersecurity vulnerabilities, posing significant challenges to the banking industry and its legacy technology systems.
Governance controls
OSFI published a public bulletin on generative and agentic AI, stating: 'OSFI takes a technology-neutral, risk-focused approach to emerging technologies, including advanced artificial intelligence models such as Mythos. Our focus is not the technology itself, but how federally regulated financial institutions govern and manage the risks associated with its use.'
OSFI outlined sound practices that institutions can adopt to enhance the speed and effectiveness of risk identification, mitigation and response.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.