Anthropic has agreed to brief members of the Financial Stability Board on vulnerabilities that one of its AI models identified in the cyber defenses of the global financial system, according to a report on Monday. The briefing will focus on weaknesses that the company’s model, called Mythos, flagged across the networks that banks, clearinghouses, and payment systems rely on.
The Financial Stability Board, an international body created in 2009 to coordinate regulation of the global financial system, is drafting a report on sound practices for the use of AI in finance and plans to publish it next month for public comment. The briefing with Anthropic fits into that effort, giving regulators a look at what a frontier model can find when pointed at their own industry.
The arrangement is unusual. Most AI safety discussions between technology companies and regulators have centered on the risks posed by the models themselves. Here the model is being deployed as a tool for finding holes in other people’s systems, a shift that security researchers said reflects how quickly the technology is moving from laboratory demonstration to practical use.
Anthropic has built a reputation as the AI lab most willing to engage with governments. Its researchers have briefed officials in Washington, Brussels, and London on topics ranging from election disinformation to the dangers of autonomous weapons, and the company has made its safety frameworks public in a way that rivals have not. The Mythos work extends that pattern into a new domain: the machinery of global finance.
The choice of audience matters. The Financial Stability Board has no enforcement powers, but its members include the central banks and finance ministries of the world’s largest economies, and its recommendations have a way of becoming national regulation. A briefing that convinces those institutions that AI can map their collective exposure could reshape how they think about cyber defense, and about the AI industry’s role in providing it.
Financial institutions have been among the fastest adopters of AI for defensive purposes. Banks use machine-learning systems to spot fraud, monitor trading, and scan for suspicious activity, and they have become big buyers of the models that technology companies sell as security tools. The conversation is now running in the other direction: an AI lab telling banks what their own defenses look like from the outside.
Details of what Mythos found were not disclosed, and Anthropic declined to comment beyond confirming that the briefing had been scheduled. People familiar with the matter said the findings were described as significant enough to warrant a session with the full board membership, rather than a working group, and that the company expected follow-up discussions with individual central banks.
The episode also raises questions that regulators have only begun to address. If a frontier model can identify weaknesses in the financial system’s defenses, the same capability could be used to exploit them, and the disclosure policies around such findings remain unsettled. Security researchers said the industry is groping toward a set of norms, roughly analogous to the responsible-disclosure practices that govern software vulnerabilities, for AI-discovered flaws.
The timing is no accident. The Financial Stability Board’s own agenda has put AI near the top of its list of risks to monitor, alongside cyberattacks and the fragility of nonbank lending. Its report, due out next month, is expected to tell banks and market infrastructure operators how to govern their use of AI models and what to do when those models surface problems their own staff missed.
For Anthropic, the briefing is a chance to show that its safety research produces practical value, a claim that investors and customers are increasingly pressing the company to make. The company’s models have scored well in benchmark tests of cybersecurity knowledge, and its researchers have published work on using AI to audit code for vulnerabilities. The Financial Stability Board session puts that research in front of the officials who set the rules for the world’s financial plumbing.
The Financial Stability Board’s interest reflects a shift in how regulators think about cyber risk. For years, the dominant concern was operational: a bank’s systems go down, payments stop, and confidence erodes. The newer worry is structural: the financial system is so interconnected, and so dependent on a handful of cloud providers and software vendors, that a single well-placed attack could cascade across borders in hours. Artificial intelligence, the board’s members have concluded, cuts both ways in that scenario. It can defend the network, and it can also probe it faster than any human team.
Anthropic’s model has already earned attention in security circles. The company demonstrated earlier this year that its systems could identify vulnerabilities in open-source software libraries that human auditors had missed, and its researchers have published techniques for using models to trace attack paths through corporate networks. The Mythos work appears to be the first time the company has pointed those capabilities at the financial system as a whole, and the reaction from officials, according to people familiar with the planning, has been serious enough to move the topic onto the board’s formal agenda.
What happens after the briefing will matter more than the session itself. If the board’s report next month incorporates the findings, and if member countries begin requiring institutions to run similar checks, Anthropic will have moved from the sidelines of financial regulation to the center of it. The company’s competitors, several of which are developing their own security-focused models, will be watching closely.
