BCE and Claude Mythos: 10,000 Banking Flaws Under Pressure

The ECB and Banking Vulnerabilities

The European Central Bank (ECB) has recently urged banks in the eurozone to take immediate action to address critical vulnerabilities identified by Claude Mythos, an artificial intelligence model developed by Anthropic. In just six weeks, this model revealed over 10,000 flaws in the software used within European financial infrastructures.

The Role of Claude Mythos

Launched on April 7, 2026, as part of the Project Glasswing program, Claude Mythos has been made available to around forty selected partners, including technology and finance giants such as AWS, Apple, Google, Microsoft, NVIDIA, CrowdStrike, and JPMorgan Chase. This model automatically scans the codebases of widely used open-source software in the financial sector, detecting and reporting critical vulnerabilities before they can be exploited.

As of May 22, Anthropic's coordinated disclosure dashboard indicated that 1,596 vulnerabilities had been reported across 281 open-source projects, with 97 of them already patched by maintainers. Notably, Mozilla used Claude Mythos to identify and fix 271 flaws in Firefox 150, which is ten times more than what previous tools detected in a similar update cycle.

The ECB's Intervention

European banks heavily rely on open-source libraries in their payment, trading, and risk management systems. When a critical flaw is detected in a software dependency like OpenSSL or Log4j, it can simultaneously affect numerous institutions. The ECB, as a prudential supervisory authority, requires banks to apply necessary patches within strict deadlines to prevent any malicious exploitation.

Geopolitical Context

The context surrounding Claude Mythos is also marked by geopolitical tensions. On May 5, 2026, Anthropic, which had been banned by the Trump administration in February 2026 for its refusal to allow military use of its models, is now providing a tool deemed essential by the ECB to secure the European banking system. On May 22, Anthropic announced it was considering a "general release" of Mythos once safeguards were strengthened, signaling a possible easing after months of restrictions.

For French clients of the affected banks, the impact of these measures is indirect but significant. The patches mandated by the ECB aim to protect the systems that handle their financial transactions and personal data.