Canadian bank execs, regulators meet to discuss risks raised by Anthropic’s new AI model

Canadian bank executives and regulators met on Friday to discuss cybersecurity risks posed by Anthropic’s new AI model, a powerful tool that has raised concerns it could be used to help threat actors exploit software vulnerabilities.

The meeting of the Canadian Financial Sector Resiliency Group (CFRG) took place several days after U.S. Treasury Secretary Scott Bessent summoned the chief executive officers of the largest U.S. banks to discuss potential financial-sector risks posed by the new Claude Mythos AI model created by San Francisco-based Anthropic.

The CFRG is chaired by Alexis Corbett, the chief operating officer of the Bank of Canada. It includes members from the Department of Finance, the Office of the Superintendent of Financial Institutions and several other regulators, along with members of Canada’s six largest banks and Desjardins Group.

The discussions occurred against the backdrop of growing concerns among regulators and cybersecurity experts about the risks that AI-enabled cyberattacks pose to the financial system and other critical infrastructure. Anthropic’s latest AI model, called Mythos, appears to be able to detect and exploit vulnerabilties to a degree that could make it “exceptionally dangerous,” according to one expert.

U.S. software stocks fall as Anthropic’s new AI model revives disruption fears

Friday’s meeting was called to discuss issues related to Mythos, according to Bank of Canada spokesperson Paul Badertscher. It was not an emergency meeting, he noted.

The group “can be activated when it’s like: This is an imminent crisis and something bad is happening and we’re under cyberattack right now. This was not that,” Mr. Badertscher said.

“It can still hold situational awareness meetings at the request of its members. ‘Hey guys, we need to pay attention, there is something going on. Let’s get together and talk about this.’ That’s what this was.”

Neither Bank of Canada Governor Tiff Macklem nor senior deputy governor Carolyn Rogers attended the meeting.

The meeting earlier in the week in the U.S. included Mr. Bessent, Federal Reserve Chair Jerome Powell and the CEOs of Bank of America, Citigroup, Goldman Sachs, Morgan Stanley and Wells Fargo, according to Bloomberg.

Anthropic has described Mythos as a powerful AI model that can be used for both defensive purposes, such as companies finding and repairing vulnerabilities in software code, and offensive purposes – by threat actors exploiting those vulnerabilities.

The company said Mythos has already found thousands of vulnerabilities, including in “every major operating system and web browser.”

Anthropic decided not to release Mythos to the general public. Instead, it has made a preview version available to a select group of organizations that build or maintain critical digital infrastructure to bolster their defensive capabilities.

Dubbed Project Glasswing, the organizations involved in the Mythos preview include Amazon, Microsoft, Apple, Google, JPMorganChase, CrowdStrike, Palo Alto Networks and Nvidia, among others.

“What we appear to have here is an AI that is exceptionally capable as a defensive tool but is also exceptionally dangerous in terms of its ability to find vulnerabilities and exploit them, and this creates a major challenge for our current technology environment,” said Charles Finlay, executive director of Rogers Cybersecure Catalyst at Toronto Metropolitan University.

Mr. Finlay said it’s difficult to assess how much of what is being said about Mythos’s capabilities is hype.

However, if what Anthropic has said about the model’s capabilities is true, “we may be in an entirely new world when it comes to the comes to cybersecurity and keeping our technology secure,” he said.

David Shipley, CEO of Canadian cybersecurity software firm Beauceron Security Inc., said the model was able to find “extraordinary levels of flawed code” because it can identify patterns faster than humans can.

“It turns out there’s a lot of holes in our code, like trillions of lines of code with problems in it,” Mr. Shipley said.

Canada’s banks have been ramping up their development and use of AI to boost productivity and drive revenue, investing more money into creating platforms using the new technology.

The country’s banking regulator has set out guidelines on how financial institutions are expected to assess and manage risks arising from new technologies and cybersecurity.

While the Office of the Superintendent of Financial Institutions said it does not have any plans to issue short-term changes to its existing guidelines, which were issued in 2022, it is continuing to assess emerging threats.

“We are in active conversations with institutions to raise awareness, as well as assess this situation and its potential impact on the resilience of the financial system,” OSFI spokesperson Cory Harding said in a statement.

“We closely monitor emerging technologies, including advanced AI systems, that may affect the cyber resilience of Canada’s federally regulated financial institutions.”

The Canadian Bankers Association said in a statement that its members support the responsible use of AI, which is increasingly playing a role in cybersecurity, fraud detection, operational efficiency and customer service in the financial sector.

“Banks currently manage the risks associated with AI and other technologies responsibly through long‑standing, sector‑specific regulatory requirements and internal frameworks, including model risk management, third‑party oversight, and technology and cyber risk controls,” CBA spokesperson Ethan Teclu said in an e-mail.

Editor’s note: This article has been updated to correct the name of the Canadian Financial Sector Resiliency Group.