Canada's Banking Regulator Flags Anthropic's Claude Mythos as Major Cyber Threat to Lenders

Canada's top banking watchdog has privately alerted the nation's largest financial institutions that Anthropic's frontier AI model, Claude Mythos, could dramatically accelerate the pace of cyberattacks and shrink the window banks have to defend their systems, according to internal correspondence obtained by Reuters.

The Office of the Superintendent of Financial Institutions (OSFI) sent the warning in an April 29 email to chief technology officers, chief information security officers, and chief risk officers across Canada's banking and insurance sectors. The regulator cautioned that advanced AI systems like Mythos are reshaping the threat landscape, forcing firms to rethink how quickly they can spot and patch software flaws.

"Advanced artificial intelligence models, such as Anthropic Claude Mythos, significantly compress the timeframe for effective risk mitigation," OSFI wrote in the email, portions of which were redacted under Canada's Access to Information Act. The regulator urged institutions to adopt practices that "enhance the speed and effectiveness of risk identification, mitigation and response."

The confidential advisory marks one of the most direct warnings yet from a major financial regulator about a specific AI model, and it underscores the escalating tension between the promise of generative AI and the vulnerabilities it introduces to critical financial infrastructure.

A New Breed of Cyber Risk

Cybersecurity experts have described Mythos as exceptionally capable at finding and exploiting software vulnerabilities, a skillset that poses acute dangers for banks still running on legacy technology systems. The model's proficiency at automating complex cyber operations has drawn scrutiny from regulators on both sides of the border.

Earlier in April, senior Canadian banking executives met with regulators to discuss the risks tied to Mythos. That gathering came on the heels of an urgent meeting in Washington, where U.S. Treasury Secretary Scott Bessent and then-Federal Reserve Chair Jerome Powell convened major bank CEOs to warn about the cyber threats posed by Anthropic's latest AI system.

The concern is not theoretical. Euro zone banks are currently excluded from accessing Mythos, reflecting the model's perceived potency. In the United States, Anthropic has navigated a rocky relationship with the government — a federal judge blocked the Pentagon's initial attempt to blacklist the company in March, though tensions have since eased following the private release of Mythos.

Canada's government has disclosed that it has access to Anthropic's Project Glasswing, a platform that enables organizations to use Mythos. It remains unclear which, if any, Canadian banks are actively using the system. Several lenders deferred questions to the Canadian Bankers Association, which stated that banks have invested heavily to protect the financial system and are complying with OSFI's robust requirements on cyber risk management and incident reporting.

Banks Race to Build AI Defenses

Canada's Big Six banks — Royal Bank of Canada (RY), TD Bank (TD), BMO (BMO), Bank of Nova Scotia (BNS), CIBC (CM), and National Bank of Canada (NA) — have all disclosed AI initiatives ranging from customer service chatbots to internal software development tools. Several have outlined plans to generate millions in value from their AI investments as they shift from experimental projects to scaled deployments.

Bruce Ross, chief technology officer at RBC, described Mythos in a June interview as a watershed moment for the industry. "The way we're dealing with it is, building our own AI defenses... we'll continue to do that," Ross said, emphasizing that attack methods can now emerge as soon as new vulnerabilities are identified.

OSFI's approach remains technology-neutral on paper. In response to questions from Reuters, the regulator published a broader public bulletin on generative and agentic AI, stating: "Our focus is not the technology itself, but how federally regulated financial institutions govern and manage the risks associated with its use."

Still, the April email signals that regulators are paying close attention to specific models, not just abstract categories of risk. The acknowledgment from OSFI could effectively compel Canadian banks, insurers, and other regulated entities to invest more aggressively in technology designed to shield clients from AI-powered cyber threats.

Global Regulatory Ripple Effects

The Canadian warning adds to a growing chorus of regulatory concern worldwide. As frontier AI systems grow more capable of identifying weaknesses and automating attacks, financial watchdogs are grappling with how to supervise institutions that may be both beneficiaries and targets of the technology.

Anthropic remains a privately held company, meaning its shares are not available on public markets. Investors tracking the firm's trajectory can monitor its valuation, funding rounds, and any potential initial public offering developments through private company research platforms. The company's Mythos model, meanwhile, continues to draw attention not just for its capabilities but for the regulatory debates it has ignited across multiple jurisdictions.

For Canada's financial sector, the message from OSFI is clear: the timeline for responding to cyber threats has shrunk, and the tools required to keep pace must evolve just as quickly.