US Regulators Pause Bank Cybersecurity Exams Over AI Model Risks
US banking regulators paused cybersecurity examinations of major banks after Anthropic's Mythos AI model was found to pose potential cyber attack risks. The model can identify code vulnerabilities and hacking weaknesses, prompting regulators and banks to conduct security assessments before resuming normal examination schedules.
What happened
Anthropic PBC announced last month that it would limit access to Mythos, its new AI model, warning that the system could potentially be used to power cyber attacks.
The Federal Reserve and Office of the Comptroller of the Currency paused some cyber-related examinations of the largest US banks to give lenders time to assess and bolster their systems against cyber threats exposed by Mythos.
Anthropic created Project Glasswing, an initiative allowing select companies including Apple Inc and JPMorgan Chase & Co to use Mythos to test their own cyber defences. In April, Treasury Secretary Scott Bessent and then-Fed Chair Jerome Powell summoned Wall Street leaders to warn them of the cyber risks raised by Mythos.
Reported impact
Bank executives were immediately alarmed by Mythos's ability to move quickly through code and identify hacking weaknesses.
Index analysis
The OCC is conducting its own trial run with Mythos to stress-test defences against the model's capabilities.
Governance controls
Regulators paused some cyber exam schedules to give banks time to understand the power of the new technology, though examiners remain engaged with firms on cyber issues. Fed Vice Chair for Supervision Michelle Bowman stated that the regulator would find effective ways to supervise banks for emerging technologies such as Mythos.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.