Canadian Banks Warned of Advanced AI-Driven Cybersecurity Threats

By Tahani Elghazaly
Published July 14, 2026

Latest news on WhatsApp أجدد الأخبار على واتساب

Canada’s financial regulator privately warned the country’s largest banks and insurance companies about growing cybersecurity risks linked to advanced artificial intelligence models capable of identifying and potentially exploiting software vulnerabilities at unprecedented speed.

According to an internal message obtained by Reuters through an access-to-information request, the Office of the Superintendent of Financial Institutions, known as OSFI, sent the warning on April 29 to senior technology, cybersecurity and risk-management officials at federally regulated financial institutions.

The message cited Anthropic’s Claude Mythos as an example of an advanced AI system that could significantly reduce the time banks have to identify and repair security weaknesses before attackers attempt to exploit them.

The warning does not indicate that a Canadian bank has been breached using the model, and the documents did not identify a specific threat targeting customer accounts. It instead reflects growing concern that AI tools could allow cybercriminals to examine software, locate vulnerabilities and develop attack methods faster than traditional hacking operations.

Anthropic has said Claude Mythos identified thousands of high-risk vulnerabilities during testing, including previously unknown weaknesses in widely used operating systems, browsers and other software.

The model has not been released to the public. Access has been limited to selected technology and security organizations so they can study its capabilities and prepare for possible misuse.

Financial institutions face particular risks because their technology networks often combine modern systems with older software developed over many years. Banks may also rely on the same outside vendors and platforms for payments, customer verification and other services.

A serious vulnerability in a widely used system could therefore expose several institutions within a short period.

OSFI said its approach is focused on risk management rather than banning a particular model or technology. The regulator wants banks and insurers to demonstrate that they can identify, control and monitor the risks connected to generative and autonomous AI systems.

The regulator urged financial institutions to establish clear limits on what AI systems are permitted to do, prevent employees from entering sensitive data into public or unauthorized tools and maintain meaningful human oversight over important decisions.

OSFI also warned that AI could increase the scale and sophistication of cyberattacks by creating more convincing phishing messages, generating malicious software and automating attempts to exploit security weaknesses.

At the same time, banks may use the technology defensively to identify suspicious activity and respond to attacks more quickly.

The Canadian Bankers Association said financial institutions have invested heavily in protecting the country’s banking system and are already subject to strict cybersecurity and incident-reporting requirements.

The warning does not mean customers should withdraw their money or stop using online banking. It does, however, reinforce the importance of enabling multi-factor authentication, protecting access codes, avoiding unexpected links and regularly reviewing accounts for suspicious transactions.