The news: US regulators are escalating concerns about advanced AI-driven cyber risk, summoning CEOs of systemically important banks to an urgent meeting about Anthropic’s new Mythos. The triggering event was the fear that Anthropic’s latest model could enable a new class of sophisticated cyberattacks.

How it works: Mythos is Anthropic’s latest model, which in testing autonomously discovered security exploits. It can be used as a defensive AI cybersecurity tool, but it can also be weaponized. Anthropic restricted access to a small group of firms, including large tech companies and banks, which are participating in a project to protect critical systems before the model goes live.

Zoom out: The concern isn’t just Mythos itself, but that equally sophisticated models—potentially developed outside Anthropic—could soon emerge and be misused. Regulators are worried about scalable, lower-cost cyberattacks; faster discovery of vulnerability that defenders can protect against; and a reduced barrier to entry for cybercrime. By proactively giving Mythos to large companies, Anthropic is trying to help them strengthen their cyber defenses before those threats materialize.

Implications for banks: Regulators’ emergency attention to the risks of Mythos signals that threats from AI-driven incursions are a supervisory priority for the biggest banks. But smaller banks may be more vulnerable than banks with the resources to build modern defenses. And nearsighted attention to evolving threats worsen the risk.

The federal government’s extensive documented guidance on information security, which is from 2016, was written for an era when there could be breathing room between the identification and mitigation of security threats. This puts banks that depend only on this guidance a decade behind, meaning they should be deeply concerned about the ability of their systems to ward off intruders. They’ve already faced many cyberthreats, and some have suffered data breaches. Preparation for the AI era should have started years ago.