Australia’s Financial Regulator Just Told Banks to Brace for Frontier AI Attacks
Australia's corporate watchdog warned the financial sector Friday to take "urgent action" against cyber threats from frontier AI systems—naming Anthropic's Mythos model as the specific concern.
The Australian Securities and Investments Commission published a letter to the entire financial services industry saying the advent of frontier AI models "materially increases risk, with the ability to expose vulnerabilities faster than many realise." Commissioner Simone Constant told firms: "Do not wait for perfect clarity to address the threat posed by new AI models. Instead, act now."
The warning follows Australia's banking regulator APRA issuing similar guidance last month that domestic banks' cybersecurity practices were failing to keep pace with AI development. Constant said "the clock is at a minute to midnight."
Anthropic's Mythos, released under its restricted Project Glasswing program, has high-level coding capabilities that experts warn give it a potentially unprecedented ability to find cybersecurity vulnerabilities. Access has been limited to major technology firms including Amazon, Microsoft, Nvidia, and Apple.
## The Real Story Underneath
This is not a generic "AI is scary" warning from a regulator trying to look relevant. This is a financial regulator telling an entire sector to change its defensive posture because a specific named AI model has capabilities that render previous assumptions about attack speed and complexity obsolete.
That matters because it reveals a structural incentive problem at the center of the AI industry.
Anthropic built Mythos for commercial reasons—it is the most capable coding model ever released, and the firms paying for access are using it to accelerate their own development. The same capabilities that make it extraordinarily useful for building software also make it extraordinarily useful for finding and exploiting vulnerabilities in other people's software.
The gap between offensive capability and defensive readiness is the core issue. A Cambridge Centre for Alternative Finance survey found that financial institutions are adopting AI at more than twice the rate of their supervisors. Only two in ten regulators report "advanced AI adoption." The people building the walls are outpaced by the people who now have better tools to find cracks.
The ASIC letter is essentially saying: the old equilibrium is broken. The speed at which a well-resourced attacker can probe for weaknesses has increased dramatically, and the financial sector's current cybersecurity practices were calibrated for a slower threat environment.
What makes this particularly interesting from an incentive standpoint is who benefits from the resulting uncertainty. Anthropic sells Mythos access to the same technology firms that also sell cybersecurity services to the banks now being told to upgrade. Amazon Web Services, Microsoft Azure, and Nvidia's security ecosystem all stand to gain from the urgency ASIC just created.
This is not a conspiracy—it is simply how concentrated platform power works. When a small number of firms control both the most capable offensive AI tools and the defensive infrastructure that everyone else needs, the incentive to "move fast" on capability and "move carefully" on safety is baked into the business model.
The Australian regulator's letter is honest about this tension. It does not pretend the problem is solved by better compliance checklists. It is telling banks that the threat model has fundamentally shifted—and that the companies selling them AI tools are the same ones whose products created the new threat surface.
For citizens, the downstream risk is straightforward: if the financial system's cyber defenses are outpaced by AI-powered attack tools, the consequences land on depositors, borrowers, and taxpayers. Bank cyber failures become bailout conversations. Data breaches become identity theft at scale. The cost of frontier AI capability does not stay inside the technology industry—it gets distributed across everyone who depends on the institutions those models can now probe more effectively than any human team.