The European Central Bank warned eurozone banks to increase cybersecurity investment to counter risks from advanced artificial intelligence models.
This directive comes as AI systems gain the ability to identify software vulnerabilities, which could allow attackers to launch more sophisticated cyberattacks against the global financial system.
Vice President Luis de Guindos and the ECB issued the warning in mid-April 2026 [1, 2]. The central bank specifically highlighted the capabilities of new AI models, such as Anthropic’s Mythos, which can discover software flaws [1, 3]. These capabilities pose a systemic risk to financial stability by potentially exposing critical infrastructure to rapid, automated exploitation.
Bankers across the eurozone are being urged to speed up the deployment of their cyber defenses [2]. The ECB headquarters in Frankfurt, Germany, identified the need for these measures because AI-driven threats can evolve faster than traditional security patches [1, 2].
According to a report from April 15, 2026, the ECB is concerned that the speed at which these models can analyze code exceeds previous human-led discovery methods [1]. This shift requires a fundamental change in how banks monitor their digital perimeters, moving from reactive to proactive defense strategies.
While the ECB has not mandated a specific budget increase, the push for higher spending reflects a growing urgency to protect the integrity of the eurozone's monetary framework. The bank said that the intersection of generative AI and cybersecurity is now a primary concern for regional financial oversight [1, 2].
“Advanced AI models could identify software vulnerabilities and enable more sophisticated cyberattacks.”
The ECB's warning signals a transition in the cybersecurity landscape where the 'arms race' between attackers and defenders is now powered by large language models. By specifically naming models like Mythos, the ECB is acknowledging that AI is no longer just a tool for efficiency, but a weapon capable of automating the discovery of zero-day vulnerabilities, potentially rendering traditional software update cycles obsolete.
