The European Central Bank (ECB) has called on banks across the euro area to urgently address cybersecurity risks emerging from the rapid advancement of artificial intelligence (AI) technologies. The ECB warns that AI tools, such as Anthropic’s Claude Mythos Preview, can quickly uncover and exploit vulnerabilities in banking systems, demanding faster and more robust security responses.
Frank Elderson, Vice-Chair of the ECB Supervisory Board, highlighted in a recent supervision newsletter that AI has shifted cybersecurity threats from being minor technical issues to urgent business risks. He emphasized that traditional patching schedules are no longer sufficient because AI systems can identify software flaws within minutes of patches being released. This accelerated threat landscape means banks must shorten the time between discovering vulnerabilities and fixing them.
The ECB’s message comes as European banks face pressure to modernize operations and integrate AI more deeply for functions like fraud detection and compliance. However, supervisors stress that the speed of AI adoption cannot come at the cost of understanding and managing new security exposures. Old banking infrastructures, complex vendor relationships, and layered authentication systems increase the challenge of protecting customer funds and market infrastructure.
Elderson pointed out three critical capabilities of AI models like Mythos: they can autonomously find and exploit security gaps at scale; combine smaller weaknesses into more serious attacks; and reverse-engineer software patches faster than ever before. These powers mean vulnerabilities once considered minor could now lead to significant breaches if left unaddressed.
Moreover, European banks currently lack direct access to some advanced AI tools available in the United States, which complicates their ability to test and defend against these emerging threats. Despite this disadvantage, the ECB stresses that it is not an excuse for inaction. Malicious actors may soon have access to these technologies, making proactive defense essential.
The ECB also reminds banks that AI-related risks fall under existing regulatory frameworks such as the Digital Operational Resilience Act (DORA). This EU regulation requires financial institutions to manage information technology risks rigorously, report incidents promptly, and oversee third-party providers carefully. AI integration thus demands stronger governance, risk management, and vendor oversight.
As a result, banks are expected to increase investments in vulnerability management, identity controls, security testing, and resilience planning. They will also face tougher scrutiny from regulators who want clear evidence that AI risks are being identified quickly and mitigated effectively. The ECB’s stance makes it clear: AI is no longer just a tool for innovation but a critical factor in operational resilience that must be treated with urgency.
While AI can enhance defense by helping identify weaknesses before attackers do, the balance has shifted. The same powerful technology can become a threat if misused or poorly managed. European banks must adapt swiftly to this new reality to protect their systems and maintain trust in the financial system.
