Table of contents
The European Central Bank (ECB) summoned, in the week of May 25, 2026, eurozone supervised banks to address cybersecurity risks related to foundational AI models - primarily Mythos, the tool from Anthropic integrated into the Project Glasswing program. As of May 22, 2026, negotiations between the European Union and Anthropic on access for European banks to Mythos remain stalled, as reported by Crypto Briefing: institutions supervised by Frankfurt are exposed to the same software vulnerabilities as their American counterparts without having the detection tool that the ECB now asks them to integrate into their cyber posture. The DORA regulation, applicable since January 17, 2025, imposes a harmonized framework for ICT risk management but does not provide any sovereign access to a third-party offensive AI tool - European supervision presses its banks without holding the lever it asks them to activate. "There are a whole range of cybersecurity issues we have been working on with banks for years, all of which remain valid, but given the advances in AI, they need to be addressed more quickly," (free translation) said to the Financial Times Frank Elderson, member of the ECB's executive board and vice-chair of the Supervisory Board until December 14, 2028. The tool remains reserved for about forty organizations, mostly American - no European bank is on the list.
An Acceleration of the Exploitation Cycle of Flaws
The urgency expressed by Elderson is due to Mythos shifting the operational balance between attack and defense. The tool is capable of detecting thousands of zero-day vulnerabilities in banks' systems, according to elements reported by The Next Web based on Elderson's interview with the FT. The vice-chair of the Supervisory Board specified that a software patch can now be reverse-engineered in about thirty minutes, compared to several weeks previously. This shortening of the delay between the publication of the patch and the weapon exploiting the fixed flaw qualitatively changes the remediation dynamics: the window during which an institution remains vulnerable after a patch is released has significantly contracted. Regarding the scope, according to the official list from Anthropic, the launch partners of the program include AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, Nvidia, and Palo Alto Networks - a dozen mainly North American players. Reuters documented that American banks with access make emergency fixes, potentially causing service interruptions for their customers. The asymmetry of access between integrated American institutions and eurozone banks absent from the program is, at this stage, a fact - not a grievance.
A software patch can now be reverse-engineered in about thirty minutes - against several weeks previously.
According to Frank Elderson, member of the ECB board, quoted by the Financial Times (relayed by The Next Web, May 25, 2026).
DORA Sets the Duty, Not the Lever
The framework that the ECB activates is set by the European Regulation 2022/2554 of December 14, 2022, on the digital operational resilience of the financial sector, known as DORA, which came into application on January 17, 2025, without a transitional period for about twenty categories of financial entities. Its articles 5 to 16 impose a harmonized framework for risk management related to information and communication technologies (ICT); article 26 organizes threat-led penetration testing (TLPT), intelligence-based intrusion tests. However, no provision of the regulation provides for European sovereign access to a third-party offensive AI tool - this point is documentable by reading the text itself. The Single Supervisory Mechanism (SSM) has, according to the 2025 annual report of the ECB banking supervision, binding measures when material ICT weaknesses are found: the report recalls that in such a case, the supervisor can require remediation plans with milestones, deadlines, and dedicated resources. On the offensive tests side, the TIBER-EU framework (Threat Intelligence-Based Ethical Red-teaming, European offensive testing framework), updated to align with DORA, guides the conduct of intrusion tests aligned with article 26 DORA. Yet, these instruments guide the conduct of banks without providing them with the detection tool that the ECB now asks them to integrate into their cyber posture.
An American Precedent of Six Weeks, a Silence from European Sectoral Authorities
The ECB summoning occurs six to seven weeks after an equivalent initiative across the Atlantic. According to Reuters relayed by AOL, on April 7, 2026, Treasury Secretary Scott Bessent and Federal Reserve Chairman Jerome Powell convened an unannounced emergency meeting in Washington with leaders of systemic American banks - Jane Fraser for Citigroup, Ted Pick for Morgan Stanley, Brian Moynihan for Bank of America. The American lead is not due to a superior regulatory framework: the NIST Cyber AI Profile, based on the AI Risk Management Framework 1.0, remains a voluntary framework, and the American banking sector does not have a "right of access" to Mythos. The asymmetry between Washington and Frankfurt arises from a commercial decision by Anthropic on the scope of Project Glasswing, not from a hierarchy of norms. On the side of European sectoral authorities, the European Banking Authority (EBA) and the European Union Agency for Cybersecurity (ENISA) have, to date, not issued specific guidelines on offensive AI like Mythos in 2025-2026 - the EBA guidelines on ICT risk management, revised in 2025 to align with DORA, do not specifically address offensive AI like Mythos. The lock is lodged in article 26 of the regulation 2022/2554: it organizes threat intelligence-based penetration tests (TLPT) but does not require supervisors to guarantee tested entities sovereign access to the necessary tools to conduct them - a gap that neither DORA nor the regulatory technical standards adopted in 2024 by the European supervisory authorities (ESAs) fill.
The ActuIA View:
Frankfurt holds a framework, not a tool. This is the reading imposed by the May 25 summoning: the ECB can demand remediation plans, milestones, intrusion tests aligned with TIBER-EU - it cannot provide supervised banks with the vulnerability detector to which Anthropic reserves access for about forty North American actors. The prudential pressure is real; the operational lever is elsewhere. The diagnosis is not new: the ENISA Threat Landscape 2025, published in October 2025, already documented the professionalization of offensive AI (Xanthorox AI and others) and the acceleration of the flaw exploitation cycle at the European level - without a sovereign industrial response following. For the risk and cyber departments of the supervised institutions, the work to be done before the FSB report expected in June 2026 is concrete: document now the gap between the detection capabilities effectively available on the European side and the ECB prudential expectations - it is this gap, and only it, that will protect in case of inspection.