The European Central Bank is paying closer attention to how advanced AI models could increase cyber risk for banks. Reuters reported in April 2026 that ECB supervisors were gathering information about Anthropic's Mythos model and preparing to discuss banks' readiness through regular supervisory contacts. The concern is not that every AI tool is automatically dangerous, but that new cyber-capable models may make it faster and cheaper to find software weaknesses.
Supervisors are looking at preparedness
According to Reuters, the ECB's work is aimed at understanding whether eurozone banks are prepared for a possible new source of cyber risk. Mythos has drawn attention from regulators because cybersecurity experts see it as capable of increasing pressure on legacy banking systems. An ECB spokesperson declined to comment to Reuters, and the reported process was described as part of ordinary supervisory dialogue rather than an emergency meeting with senior bank executives.
The issue matters because banks already rely on complex technology stacks, third-party vendors, cloud services and automated decision systems. If a powerful model can identify vulnerabilities more quickly, institutions may have less time to patch weaknesses before attackers learn the same information. That turns AI from a narrow technology topic into an operational resilience question.
Third-party exposure remains a weak point
Many financial institutions do not build every AI or security tool in-house. They buy software, use cloud infrastructure and connect internal systems to outside providers. That can speed up adoption, but it also makes responsibility harder to trace when something fails. A model, vendor platform or integration point can introduce risk even if the bank's own application appears stable.
The ECB has already warned in broader research that artificial intelligence can bring benefits and risks to financial stability. The May 2024 Financial Stability Review noted that AI can improve productivity and risk management, but also raises questions around data, model governance, cyber risk and concentration among technology providers. The latest Mythos-related reporting gives those older concerns a more immediate test case.
The warning is about control, not panic
Other central banks have also moved in the same direction. Bank of England Governor Andrew Bailey said regulators needed to understand what a new cyber-capable AI model could mean for banks and technology systems. The Bank of England separately told lawmakers it was testing AI risks through scenario analysis and simulations.
For banks, the practical message is clear: AI adoption cannot be treated only as an efficiency project. Institutions need evidence that models are tested before deployment, monitored during use and isolated quickly if abnormal behavior appears. They also need a clear view of which vendors, APIs and infrastructure providers sit behind critical functions.
The ECB's reported questions do not amount to a ban on AI in banking. They signal that supervisors want risk controls to move at the same speed as the technology. For a sector built on trust, that is the right pressure point. The more capable AI systems become, the more banks will have to prove that they understand not only what those tools can do, but also how they can fail.
