Australia, NZ banks watch Anthropic Mythos AI risks

The Reserve Bank of Australia and Reserve Bank of New Zealand said they are monitoring Anthropic’s Mythos AI model, after warnings that it could raise cybersecurity risks for banks and critical systems.

Anthropic said early testing found thousands of major vulnerabilities in operating systems and browsers, while experts warning the model could exploit unknown flaws faster than companies can patch them.

The model is a double-edged sword because it could strengthen digital defenses but also help attackers, said Bundesbank President Joachim Nagel.

Anthropic said access has been given to major tech firms and more than 40 other organizations supporting critical software infrastructure.

🔗 Source: Reuters

🧠 Food for thought

Implications, context, and why it matters.

Financial watchdogs are treating this like a broad threat

The response reaches well beyond Australia and New Zealand, with talks taking place at senior levels 1. In the U.S., bank chiefs were called into an urgent meeting on the risks by Scott Bessent, Treasury secretary, and Jerome Powell, Federal Reserve chair 1.
Bank of England governor Andrew Bailey warned that Anthropic may have opened a path to much wider cyber risk 2. The model also came up at International Monetary Fund (IMF) and World Bank meetings in Washington, DC 2.
Europe is also moving. The European Central Bank is gathering details and plans to question bankers through its regular talks with bank staff 1. Regulators in Hong Kong, Singapore, and South Korea are reviewing bank defenses as well 3.

Cybersecurity money is moving from finding flaws to fixing them

Mythos could shift the economics of security research by cutting the cost and time needed to spot software flaws. Anthropic said one run that uncovered a now-patched 27-year-old OpenBSD bug cost under $50, while a wider search across 1,000 runs cost under $20,000 4. OpenBSD is a long-running open-source operating system known for its security focus.
Fixing flaws after they are found is now the choke point 5. Anthropic said Mythos Preview has found thousands of vulnerabilities, yet fewer than 1% have been fully patched because disclosure timelines move slowly and maintainers have limited capacity 4.
That shifts value away from discovery work such as penetration testing and toward tools that sort issues, rank risk, and manage fixes at scale 5. Penetration testing is the practice of simulating attacks to find weaknesses in systems.
Analysts expect business models to change. Vendors built on finding weaknesses rather than resolving them may lose ground 5.