Canada warns top financial institutions of advanced AI risks

The Office of the Superintendent of Financial Institutions warned Canada's largest financial organisations about the severe cybersecurity risks posed by advanced artificial intelligence models. The federal banking regulator stated that this emerging technology could significantly escalate cyber threats and shrink the time frame available to identify and patch system vulnerabilities.

Reuters reported that the Office of the Superintendent of Financial Institutions sent a direct warning to chief technology officers, chief information security officers, and chief risk officers across the sector. The regulator, alongside the Bank of Canada, targeted executives at major institutions including Royal Bank of Canada, TD Bank, and BMO.

The urgent briefing highlighted the rise of frontier-class artificial intelligence systems, specifically pointing to Anthropic's Claude Mythos. This powerful model is designed for advanced software security, but Anthropic has withheld it from the general public because of its extreme capabilities.

The model was originally built to help organisations scan code and patch software flaws. However, security evaluations by the United Kingdom AI Safety Institute revealed that Claude Mythos can autonomously execute multi-step processes to achieve complete network takeovers. If accessed by malicious actors, the technology effectively becomes an incredibly efficient hacking tool.

The regulator warned that these advanced AI models drastically reduce the time banks have to defend their networks. In the past, security teams had days or weeks to deploy software fixes once a flaw was discovered. Tools like Claude Mythos allow threat actors to find and exploit those vulnerabilities instantly on a massive scale.

In the official warning, the Office of the Superintendent of Financial Institutions stated that advanced artificial intelligence models significantly compress the timeframe for effective risk mitigation. The agency added that its focus remains on how federally regulated financial institutions manage and govern the risks associated with emerging technologies.

While Canada has gained restricted defensive access to the platform under Anthropic’s "Project Glasswing," regulators remain concerned that financial legacy systems are not updating fast enough. Regulators worldwide are continuing to assess the broader security implications of the model.