Global Cyber Rules Must Keep Pace With AI Tools, Bank of England Chief Warns

Bank of England Governor Andrew Bailey delivered a pointed message from Reykjavík this week: British banks still lack access to Anthropic's advanced AI vulnerability hunter, Mythos. The tool can uncover software bugs faster than human experts, but concerns about its power have stalled deployment. Speaking with Bloomberg Television, Bailey noted that banks continue testing defenses with other models while this one remains off-limits.

The delay is tied to Glasswing phase two, an initiative in development for about six weeks that has become entangled with U.S. administrative processes. “Given our concerns about the risks involved, it is really important there is access,” Bailey said, highlighting the tension between stronger defenses and fears of misuse.

Bailey pushed for a broader solution. “The spillovers from this sort of cyber risk are so big that we can’t just have a single national approach,” he told Bloomberg’s Stephanie Flanders. “There’s got to be an international approach.”

The Bank of England’s CBEST program already supports cross-jurisdictional testing, allowing assessments alongside other regulators. The G7 Fundamental Elements provide alignment, while the Bank works with the PRA, FCA, and NCSC to share anonymized reports across the industry. Recent joint guidance from UK authorities warned that frontier AI models can exceed human capabilities in speed, scale, and cost, urging boards to prioritize security investments and automated vulnerability detection.

Bailey chairs the Financial Stability Board, which will receive briefings on Mythos. His message reflects a growing consensus: cyber risk is now a stability issue, not just an operational one. National efforts alone cannot protect interconnected payment systems, cloud providers, and supply chains. The question is whether governments can align quickly enough to match the pace of innovation and threat.