The European Central Bank has issued a formal warning to the euro area’s largest banks regarding the serious cyber threats posed by frontier AI models. Claudia Buch, chair of the ECB’s supervisory board, directed bank CEOs to prepare plans by the end of October, emphasizing faster software patching, hardened AI-enabled defenses, and tighter oversight of external technology providers. Over the longer term, banks are urged to modernize aging infrastructure and improve crisis response capabilities. Although the directive carries no fines or formal sanctions, the ECB may use the submitted plans to rank lenders and pressure underperformers.
A key concern highlighted is Anthropic’s Claude Mythos model, which can identify unknown flaws in IT systems and has reportedly spotted thousands of severe vulnerabilities. Buch noted that emerging models can pinpoint weaknesses and write working exploits at unprecedented speed, collapsing the traditional gap between discovery and exploitation. The European Systemic Risk Board simultaneously raised its assessment of systemic cyber risk to “severe,” classifying frontier AI as a source of systemic risk in its own right and flagging Europe’s dependence on non-EU AI providers.
This action aligns with broader European concerns, including warnings from ECB President Christine Lagarde about AI potentially triggering financial crises. The ECB has already conducted severe cyber-attack drills on 109 banks amid rising state-backed attacks. A market for defensive tools is emerging, with firms like French startup Mistral offering flaw-hunting solutions as a domestic alternative to Mythos. While the regulatory response acknowledges the danger clearly, concrete fixes remain vague, and the October deadline may reflect the deliberate pace of banking institutions.