ECB presses banks to speed patches after AI model exposes flaws

The European Central Bank summoned 111 significant euro-area banks to a Tuesday meeting to urge faster software patching after Anthropic’s Claude Mythos preview surfaced new cyber exploits.

ECB Vice-Chair Frank Elderson told banks the rollout of fixes must speed up because attackers can reverse-engineer patches in about 30 minutes, making current patch schedules inadequate. He asked U.S. institutions attending the meeting to share testing insights with Eurozone counterparts so lenders without direct access to frontier models can benefit.

Elderson warned that the previous pace is too slow and used a musical comparison: ‘andante may have been good enough, but we need to go to presto.’ He noted the ECB has engaged banks on cybersecurity for years and that recent AI advances require faster operational responses.

Anthropic released a preview of Claude Mythos in April under Project Glasswing, a restricted program that gives some organizations controlled access to advanced models for testing. The U.K. AI Security Institute found Mythos Preview solved 73% of expert-level Capture the Flag challenges, a benchmark no model had reached before April 2025.

The scale of findings has affected software suppliers. A major browser vendor shipped an update containing 271 fixes after using the model to surface vulnerabilities.

Many European lenders do not participate in Project Glasswing and rely on vendor disclosures and external reports to identify issues. Elderson called the access gap ‘unfortunate’ but added it cannot justify slower patching.

The ECB expects banks to improve vulnerability management, share technical testing results, and shorten the time between discovery and deployment of fixes. Banks will be asked to report patch management timelines and to outline plans to harden critical systems. The supervisory remit covers 111 significant euro-area banks and the authority said it will press for better coordination among supervised institutions, software suppliers and external testers to limit windows of exposure.