U.S., U.K. and Canadian Regulators Warn Advanced LLMs Pose Cyber Risks to Financial System

Banks often layer new services onto legacy systems that have operated for years, while widely sharing account-opening, KYC and trading software. If an LLM capable of finding vulnerabilities across systems were misused, an attack could spread rapidly from a single institution through the financial system. The U.S. Treasury and Federal Reserve, the U.K.’s National Cyber Security Centre, and Canada’s Department of Finance and Bank of Canada have therefore identified Claude Mythos as a cybersecurity concern.

Anthropic unveiled Claude Mythos Preview on April 7, 2026. An April 13 assessment by the U.K. AI Security Institute found that it achieved a 73% success rate on expert-level capture-the-flag challenges and completed all 32 steps in three of 10 enterprise attack tests. OpenAI expanded access applications for GPT-5.4-Cyber on April 14, adding malware analysis and binary reverse engineering. No financial amounts were involved or disclosed.