UK Banks Locked Out of Anthropic's Mythos, and That Should Worry Us All

Key points worth noting:

• Anthropic's Mythos is apparently the benchmark for AI-driven cybersecurity testing right now
• UK banks have no access, full stop
• Bailey is publicly calling for international cooperation, which suggests bilateral negotiations have stalled
• Other models are being used as stopgaps, but their effectiveness compared to Mythos remains unclear
• This isn't a technical problem, it's a geopolitical and commercial one

I called my old colleague at Siemens last week about something unrelated, and we ended up talking about this. His take was that Anthropic is being cautious about which institutions get Mythos access, probably for liability reasons. Makes sense. If your AI tool finds a vulnerability and someone exploits it before it's patched, who's responsible? The lawyers must be having a field day.

But caution has costs. The UK financial system handles trillions in transactions. If British banks are testing their defenses with second-tier tools while American and (presumably) some European institutions have access to the real thing, that's a gap that bad actors will notice. They always do.

What bothers me most is the lack of specifics. Bailey didn't say when access might come, or what the actual barriers are. Is it regulatory? Commercial? Some combination? We don't know yet. And that uncertainty, in my experience, usually means the people in charge don't know either.

I've seen this pattern before in industrial automation. A critical technology gets siloed, everyone assumes someone else is handling access negotiations, and then you wake up one morning and realise your competitors have been running circles around you for three years. The financial sector moves faster than manufacturing, which means the damage accumulates quicker too.

Maybe I'm being alarmist. It's possible UK banks have perfectly adequate cybersecurity and Mythos is just a nice-to-have. But when Andrew Bailey, not exactly known for public handwringing, goes on camera to flag this as a problem, I'm inclined to take it seriously.

The multinational approach he's calling for is the right idea. Cybersecurity threats don't respect borders, and neither should the tools we use to fight them. Whether that actually happens, well, that's above my pay grade. But someone should be working on it. Preferably before we find out the hard way what that zero access really costs.

Aisha Patel · 25 Jun · 8 min