The European Central Bank has asked eurozone banks to strengthen their defences against cyberattacks by November, amid concern that the rapid progress of artificial intelligence could create new systemic risks for the financial system.
The ECB’s warning
The ECB wants banks to improve monitoring, fix known vulnerabilities in their systems more quickly and be ready to isolate parts of their networks in the event of an attack. Supervisors worry that the timeframe is tight, given how quickly AI capabilities are advancing compared with the pace at which large institutions can upgrade their security.
Why AI changes the picture
Advanced AI models are becoming very good at writing and analysing code — including finding security flaws. That cuts both ways: the same capabilities that help defenders find and fix vulnerabilities could, in the wrong hands, help attackers find them first.
The Mythos case
In 2026, Anthropic announced Claude Mythos Preview, a model with advanced capabilities in software and cybersecurity. Rather than release it to the public, the company made it available only to a limited group of trusted organisations through an initiative called Project Glasswing, so that they could use it to find and fix vulnerabilities in critical software before attackers could exploit them.
The decision illustrated a dilemma facing the industry: how to make powerful tools available for defence while limiting the risk of misuse.
The key word: vulnerability
For banks, the central concern is vulnerabilities — flaws in software that could allow attackers into their systems. Many institutions still depend on older systems that are difficult to update, which makes them particularly exposed.
How banks can prepare
- Secure by design: build security into new systems from the start.
- Continuous monitoring: detect unusual activity in real time.
- Rapid isolation: be able to cut off compromised systems quickly.
- Regular testing: run simulated attacks to find weaknesses.
- Faster patching: shorten the time between discovering a flaw and fixing it.
Why it’s systemic
Banks are deeply interconnected and rely on shared technology providers. A successful attack on a major institution or a widely used supplier could spread across the system, disrupting payments and undermining confidence. That is why supervisors treat cyber risk as a threat to financial stability, not just to individual banks.
For customers
Customers can also protect themselves: use strong, unique passwords, enable two-factor authentication and be wary of messages asking for banking details — a type of fraud that AI is also making more convincing.
