By Jennifer Calver and Simon Treacy
In early 2026, Anthropic announced the release of Claude Mythos, a model with significantly stronger cyber capabilities than its predecessors.
The company initially chose not to launch Mythos publicly because of concerns that its cybersecurity capabilities could potentially be misused. It has since rolled out the platform with restricted access, meaning it is only available to vetted businesses to prevent the technology falling into the wrong hands.
In an ever changing threat landscape, financial services will need to consider what this means for their operational resilience and compliance with regulatory obligations. In doing so, they should anticipate that Mythos marks the start of a trend requiring firms to continuously review their vulnerabilities as AI models improve.
Anthropic claimed that Mythos could identify and exploit hidden vulnerabilities across all major operating systems and browsers. Early testing suggested it could autonomously generate working exploits and discover thousands of critical flaws. When released to the public, Mythos could dramatically lower the barrier to sophisticated cyberattacks.
The financial sector’s exposure is not only its attractiveness to attackers but also its underlying architecture. Modern financial systems are highly interconnected. The International Monetary Fund has warned that AI‑driven cyber capabilities increase the risk that vulnerabilities in shared infrastructure could quickly multiply across institutions, elevating AI-enabled cyber risk to a financial stability concern.
A natural response to the threat posed by models like Mythos is to look to the providers themselves to prevent misuse. AI providers like Anthropic and OpenAI have invested in guardrails designed to prevent models from being used to carry out attacks even when instructed to do so. In practice, however, these safeguards have proven difficult to enforce fully with users continuing to find ways to bypass them, particularly where novel techniques are used.
Recognising the threat from Mythos, in April 2026 Anthropic launched Project Glasswing, a collaboration between major technology and financial firms using a preview version of Mythos defensively to identify and fix vulnerabilities before they can be exploited.
But Mythos is not the only story. There are indications that GPT-5.5 can also carry out advanced cyberattacks, meaning that AI-enabled cyber threats are becoming a feature across multiple models. OpenAI have therefore announced a similar initiative called Daybreak for GPT-5.5.
As models continue to improve, they will find vulnerabilities that less capable models were unable to. The UK AI Security Institute found that AI cyber capability appears to be doubling as fast as every 4.7 months. Models released in the coming months are therefore likely to be significantly more capable at finding vulnerabilities than Mythos and GPT-5.5. The implication is that each new generation of model may render the previous round of defensive testing incomplete.
Around the world, regulators have introduced regimes requiring financial services firms to build their resilience to operational disruption, including cyber attacks. For example, the Digital Operational Resilience Act (DORA) requires EU financial entities to assess cyber threats, use their ICT risk management framework to prepare for cyber attacks and, in some cases, run threat-led penetration testing. The UK’s Financial Conduct Authority, Prudential Regulation Authority and Bank of England impose operational resilience regimes on the firms they oversee.
Now regulators are highlighting the importance of meeting these requirements to address faster and more disruptive frontier AI-driven attacks. In the UK, a joint statement from HM Treasury, the FCA and Bank of England tells firms to take proactive steps to plan for and mitigate cybersecurity risks.
For financial services firms:
Even where technical systems are secure, non-technical attacks are still a threat. In February 2026, the Dutch telecoms company Odido was hacked through the use of voice impersonations that bypassed its cyber defences. As voice impersonation, phishing and other social engineering techniques are deployed by AI at greater scale, firms will need to ensure that staff training evolves accordingly.
As AI-enabled cyber threats grow, so too does the potential legal and regulatory exposure for firms. Regulators will use regimes like DORA and the UK operational resilience framework to hold senior managers accountable for preparing to manage cyber risks and responding effectively when disruption happens. Firms that embed continuous review of their AI-related vulnerabilities into their governance frameworks will be best placed to meet their regulatory expectations, and the next Mythos.
For advice on how your company can reap the rewards of agentic AI while mitigating the risks, reach out to any of our AI experts listed on our Artificial Intelligence service page.
This article was originally published in May 2026.