On Thursday, May 7, the International Monetary Fund (IMF) issued a warning that the latest generation of AI models, exemplified by Anthropic's Claude Mythos, is escalating cybersecurity risks to a scale capable of triggering "macro-financial shocks" and potentially causing "correlated failures" at the financial system level. This marks the first time the IMF has published a dedicated article on the cybersecurity threats posed by cutting-edge AI models.

In a blog post, the IMF directly referenced the recent controlled release of Mythos, stating it "highlights the rapid pace at which risks are increasing." The IMF also explicitly stated that the defenses of financial institutions will "inevitably" be breached and called for all parties to prioritize "resilience"—that is, limiting the spread of incidents and ensuring rapid recovery.

This warning comes against the backdrop of Mythos currently being accessible to only 40 primarily US-based institutions, including major companies like Amazon, Microsoft, and banks such as JPMorgan Chase. The lack of access for numerous non-US banks and financial institutions has raised concerns about uneven levels of protection across the global financial system.

How dangerous is Mythos? Anthropic disclosed last month that Mythos had "discovered thousands of high-severity vulnerabilities, including in every major operating system and browser." Anthropic itself warned that "the impact on the economy, public safety, and national security could be severe."

What does this mean? Simply put, whereas hackers previously required significant time and cost to find system vulnerabilities, AI models like Mythos can drastically shorten this process.

Senior IMF officials wrote in the article: "Advanced AI models can significantly reduce the time and cost required to identify and exploit vulnerabilities, substantially increasing the likelihood of simultaneously discovering and attacking weaknesses in widely used systems."

The key term is "simultaneously." Financial institutions commonly use the same software and shared service providers, meaning an AI model could "simultaneously create vulnerabilities across numerous institutions." The IMF warns that if multiple institutions are attacked concurrently, "confidence effects, payment disruptions, liquidity strains, and fire-sale dynamics could follow"—this is the classic transmission path of systemic risk.

Unequal access leaves non-US institutions exposed Mythos is currently in a controlled release phase, allowing the 40 institutions with access to learn about vulnerabilities in advance and apply patches. However, this list is dominated by US entities, leaving many non-US banks and financial groups excluded.

According to the Financial Times, companies that have gained access indicate that addressing the threats revealed by Mythos requires "joint action from both the public and private sectors."

The IMF explicitly stated: "Cyber risk does not respect borders." It specifically noted that emerging markets and developing countries often face more severe resource constraints and may be "disproportionately exposed to attackers targeting weakly defended areas."

For the global financial system, this implies a structural vulnerability: the weakest link in defense could potentially become the trigger point for systemic risk.

Specific recommendations from the IMF The IMF acknowledged that financial software is "harder to attack than open-source infrastructure," but added that this advantage "could be quickly eroded as model training scales, capabilities diffuse, and leaks occur."

In other words, the current relative safety is only temporary.

The IMF's recommended responses include:

- Cyber stress testing and scenario analysis: Simulating the impact of AI-driven cyberattacks on the financial system. - Board-level oversight of cyber risks: Integrating cybersecurity into the agenda of top decision-making bodies. - Public-private collaboration on threat intelligence and incident response: Breaking down information silos. - Strengthening international cooperation: Particularly to help resource-limited emerging markets enhance their defensive capabilities.

The core logic of the IMF is that, instead of relying solely on "preventing all attacks," it is crucial to simultaneously build the capacity for "rapid recovery after a breach occurs."