British financial regulators are holding urgent talks with the government’s cybersecurity agency and major banks to assess the risks posed by the latest artificial intelligence model from Anthropic, the Financial Times first reported on Sunday.
Officials at the Bank of England, the Financial Conduct Authority and HM Treasury are in talks with the National Cyber Security Centre to examine potential vulnerabilities in critical IT systems highlighted by the new model.
The talks were confirmed to involve two people briefed on the discussions, according to the FT.
The Bank of England has placed the issue on the agenda for its next Cross Market Operational Resilience Group and CMORG AI Taskforce meetings, scheduled within the next two weeks, according to a person with knowledge of the matter.
Representatives from major British banks, insurers and exchanges are expected to be briefed on the cybersecurity risks at that meeting.
What is Claude Mythos?
Mythos Preview is a general-purpose AI model, the type of system that powers products like Claude Code or ChatGPT.
In pre-release testing, however, Anthropic found its cybersecurity capabilities were surprisingly advanced compared to previous models.
In just the past few weeks, Anthropic says Mythos Preview has identified thousands of zero-day vulnerabilities, many of which were critical and difficult to detect, including some in every major operating system and web browser.
Several of those vulnerabilities had gone undetected for years.
The oldest discovered so far was a 27-year-old bug in OpenBSD, an operating system known primarily for its strong security record.
The company says it formed the initiative in response to capabilities that demonstrate a level of coding ability capable of surpassing all but the most skilled humans at finding and exploiting software vulnerabilities.
Because of those cybersecurity capabilities and concerns they could be abused, Anthropic opted not to make the model generally available.
Project Glasswing
Rather than shelve the model, Anthropic launched Project Glasswing a controlled programme giving a limited group of organisations access to Mythos Preview specifically for defensive purposes.
Partners include Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, and Nvidia.
Anthropic has committed $100 million in model usage credits to Project Glasswing participants, alongside $4 million in direct donations to open-source security organisations.
Anthropic acknowledged the dual-use problem directly, stating: “We did not explicitly train Mythos Preview to have these capabilities.
Rather, they emerged as a downstream consequence of general improvements in code, reasoning, and autonomy.
The same improvements that make the model substantially more effective at patching vulnerabilities also make it substantially more effective at exploiting them.”
This marks the first time in nearly seven years that a leading AI company has so publicly withheld a model over safety concerns.
The last comparable instance was in 2019, when OpenAI declined to fully release its GPT-2 system.
A Coordinated International Response
The UK regulatory action is part of a wider international response. The move follows a meeting called by US Treasury Secretary Scott Bessent with major Wall Street banks to discuss the model’s cyber risk potential, Reuters reported on Friday, citing two sources.
From the US to the UK and Canada, financial regulators in major economies have all taken action within a short timeframe, a level of coordination rarely seen in recent financial regulatory history.
Anthropic has said it has been in ongoing discussions with US government officials about Claude Mythos Preview and its offensive and defensive cyber capabilities.
