ECB tells eurozone banks to tighten cyber-security as AI shifts the threat picture

The European Central Bank instructed eurozone banks to tighten cyber-security posture in response to AI-led attack tools. The shift in language turns earlier private guidance into a supervisory expectation. The trigger is Anthropic’s Mythos, a restricted-access AI model that can autonomously discover and exploit cybersecurity vulnerabilities at machine speed. Mythos can combine smaller weaknesses into more serious attacks and reverse-engineer patches into exploitable flaws faster than older toolchains. Access is limited to about 40 to 50 organizations, and no eurozone institution is included. The ECB expects banks to assume attackers have comparable AI tools even without defender access. Supervisory implications include faster vulnerability management than monthly patch cycles, auditing contractor exposure, and incorporating AI-cyber readiness into supervisory dialogues. Commercial efforts are also underway, including BNP Paribas working with Mistral and ongoing talks about expanding Mythos access to European institutions.

"The European Central Bank has formally told eurozone banks they must tighten their cyber-security posture in response to AI-led attack tools, in a follow-up statement issued on Wednesday that turns earlier private guidance into something closer to a supervisory expectation."

Read at TNW | Eu