Key facts
- Canada's Office of the Superintendent of Financial Institutions (OSFI) warned financial institutions about advanced AI models.
- The warning specifically mentioned Anthropic's Claude Mythos, noting it could increase cyber threats.
- OSFI stated that advanced AI models compress the timeframe for effective risk mitigation.
- The regulator emphasized a risk-focused approach, not the technology itself.
- Canadian banks are investing in AI defenses and applying AI in areas like chatbots.
Canada's federal banking regulator, the Office of the Superintendent of Financial Institutions (OSFI), alerted the country's largest financial institutions to the cybersecurity risks posed by advanced artificial intelligence models, including Anthropic's Claude Mythos. An email sent in April indicated that such frontier AI could escalate cyber threats and shorten the window for institutions to identify and address vulnerabilities.
OSFI communicated these concerns to technology, security, and risk officers across the financial industry. The regulator stated that advanced AI models "significantly compress the timeframe for effective risk mitigation" and outlined sound practices for enhancing risk identification, mitigation, and response. This bulletin aligns with OSFI's existing guidance and its technology-neutral, risk-focused approach to emerging technologies.
Globally, regulators are grappling with the cybersecurity implications of powerful AI. Experts note that models like Mythos are capable of identifying and exploiting vulnerabilities, presenting significant challenges for the banking sector's legacy systems. Following inquiries from Reuters, OSFI publicly posted a bulletin on generative and agentic AI.
In early April, Canadian bank executives met with regulators to discuss Mythos, shortly after U.S. Treasury Secretary Scott Bessent and then-Federal Reserve Chair Jerome Powell convened a similar meeting with bank CEOs. Three of Canada's major banks, including Royal Bank of Canada (RBC), have outlined plans to leverage AI for revenue generation, moving beyond experimental projects to applications like chatbots and internal tools.
RBC's chief technology officer, Bruce Ross, acknowledged in June that Mythos highlights a changing cyberattack landscape, necessitating rapid organizational responses and the development of AI-based defenses.