ASIC warns financial firms to strengthen cyber defences swiftly as advanced artificial intelligence models like Mythos reveal new vulnerabilities, accelerating cybersecurity risks in the financial sector.
Australia’s corporate regulator has warned that financial firms must move faster to shore up cyber defences as frontier artificial intelligence tools become more capable of finding weaknesses in digital systems.
In a letter to the financial services sector released on Friday, the Australian Securities and Investments Commission said the rise of advanced AI models had changed the threat landscape and made strong cybersecurity practices more urgent than ever. ASIC commissioner Simone Constant said the industry should not wait for perfect certainty before acting, arguing that firms need to reinforce the basics of cyber resilience now rather than later.
The warning comes as regulators increasingly focus on the risks posed by Anthropic’s Mythos model, whose advanced coding abilities have raised concern that it could be used to uncover vulnerabilities more quickly than traditional methods. In April, Australian and Asian regulators including ASIC and the Australian Prudential Regulation Authority began monitoring the model amid concern about its potential market impact and security implications.
ASIC’s intervention also builds on its own previous findings. In October 2024, the regulator’s first report on AI adoption among financial services and credit licensees identified a possible governance gap, with many firms’ oversight arrangements lagging behind their growing use of AI. The report found that about 60% of surveyed licensees planned to expand their AI use, underlining the pressure on boards and compliance teams to update controls.
The broader picture is one of rapid adoption and uneven supervision. Research published in April by the Cambridge Centre for Alternative Finance found that financial institutions are adopting AI at more than twice the rate of their regulators, while only two in 10 supervisors described themselves as having advanced AI adoption. That gap has raised questions about whether authorities can keep pace with emerging harms.
Australian industry data suggests the technology is already embedded across the private sector. A February 2026 analysis found that 67% of local fintech firms were actively using AI and 45% had deployed generative AI, with use cases ranging from fraud detection and compliance to internal document review and knowledge search. At the same time, skills shortages and unclear accountability continue to slow broader implementation.
ASIC’s latest message fits a longer pattern of concern from the regulator about technological change outstripping controls. Joseph Longo, ASIC’s chair, has previously warned that fast-moving innovation in financial services can amplify scams and cyber threats, and in earlier cybersecurity surveys the regulator said many licensees still had serious gaps in their defences, including weaknesses around third-party risk.
For ASIC, the central message is that frontier AI may offer opportunity, but it also increases the speed and scale at which attackers can probe financial systems. The regulator’s advice to firms is to treat cyber resilience as an immediate operational priority, not a future policy debate.
- https://www.businesstimes.com.sg/international/australia-regulator-calls-urgent-cybersecurity-action-counter-mythos – Please view link – unable to able to access data
- https://www.asic.gov.au/about-asic/news-centre/find-a-media-release/2024-releases/24-238mr-asic-warns-governance-gap-could-emerge-in-first-report-on-ai-adoption-by-licensees/ – In October 2024, the Australian Securities and Investments Commission (ASIC) released its first report on AI adoption by financial services and credit licensees. The report highlighted a potential governance gap, with many licensees’ governance practices lagging behind their accelerating use of AI. Approximately 60% of surveyed licensees planned to expand their AI usage, underscoring the need for updated governance frameworks to manage the associated risks effectively.
- https://www.itnews.com.au/news/asic-apra-join-asia-regulators-monitoring-anthropics-mythos-625217 – In April 2026, Australian and Asian financial regulators, including ASIC and the Australian Prudential Regulation Authority (APRA), began monitoring Anthropic’s AI model, Mythos. Its advanced coding capabilities have raised concerns about its potential to identify cybersecurity vulnerabilities, prompting regulators to assess possible market implications and ensure financial institutions are prepared to address emerging risks.
- https://www.goodfirms.co/blog/narrow-ai-generative-ai-fintech-australia – A February 2026 analysis revealed that 67% of Australian fintech firms are actively deploying AI, with 45% implementing generative AI, surpassing global averages. Narrow AI is predominantly used in fraud detection, lending, compliance, and risk management, while generative AI is gaining traction for internal applications like knowledge search and document review. Despite these advancements, challenges such as skills shortages and unclear ownership hinder broader AI adoption.
- https://www.asic.gov.au/about-asic/news-centre/speeches/asic-s-priorities-in-a-changing-regulatory-environment/ – In a speech from July 2022, ASIC Chair Joe Longo discussed the rapid technological changes transforming financial services, particularly the swift adoption of generative AI. While acknowledging the benefits, he highlighted the increased risk of harm, including scams and cybersecurity threats, emphasizing the need for regulators to adapt and address these challenges proactively.
- https://www.industry.gov.au/news/ai-adoption-australian-businesses-2024-q4 – A report from March 2026 indicated a positive trend in AI adoption among Australian small and medium-sized enterprises (SMEs). By the fourth quarter of 2024, 40% of SMEs were adopting AI, a 5% increase from the previous quarter. The services and retail trade sectors led in adoption rates, with 48% and 45% respectively, reflecting a growing recognition of AI’s potential to enhance competitiveness and operational efficiency.
- https://www.moneymanagement.com.au/asic-calls-out-alarming-cyber-security-deficiencies-afsls/ – In November 2023, ASIC released its Cyber Pulse Survey, revealing significant cybersecurity deficiencies among Australian financial services licensees (AFSLs). The survey found that 44% of participants managed third-party or supply chain risks, a statistic described as ‘alarming’ by ASIC Chairman Joseph Longo. The findings underscore the need for enhanced cybersecurity management to protect against evolving threats.
Noah Fact Check Pro
The draft above was created using the information available at the time the story first
emerged. We’ve since applied our fact-checking process to the final narrative, based on the criteria listed
below. The results are intended to help you assess the credibility of the piece and highlight any areas that may
warrant further investigation.
Freshness check
Score:
8
Notes:
The article was published on May 8, 2026, and references a letter from the Australian Securities and Investments Commission (ASIC) to the financial services industry. A similar report from Bloomberg on April 30, 2026, discusses ASIC’s warning regarding AI cybersecurity risks, particularly concerning Anthropic’s Mythos model. ([bloomberg.com](https://www.bloomberg.com/news/articles/2026-04-30/australia-regulator-threatens-enforcement-for-poor-ai-controls?utm_source=openai)) This suggests that the content is recent and not recycled. However, the Business Times article may be summarizing or republishing information from Bloomberg, which could affect its originality. The earliest known publication date of substantially similar content is April 30, 2026.
Quotes check
Score:
7
Notes:
The article includes a direct quote from ASIC commissioner Simone Constant: “Cyber risk has entered a new era, the advent of frontier AI models creates opportunity but also materially increases risk, with the ability to expose vulnerabilities faster than many realise.” This quote appears to be unique to this article, as no exact matches were found in earlier publications. However, the paraphrased content in the Bloomberg article from April 30, 2026, suggests that similar sentiments have been expressed previously. The lack of independently verifiable quotes raises concerns about the authenticity of the statements attributed to Constant.
Source reliability
Score:
6
Notes:
The Business Times is a reputable publication; however, it is based in Singapore and may not have direct access to ASIC’s communications. The article cites a letter from ASIC to the financial services industry, but no direct link or reference to the original letter is provided. This lack of direct sourcing raises questions about the independence and reliability of the information presented. Additionally, the article may be summarizing or republishing information from Bloomberg, which could affect its originality.
Plausibility check
Score:
8
Notes:
The concerns raised about the cybersecurity risks associated with advanced AI models like Mythos are plausible and align with ongoing discussions in the industry. The Australian Prudential Regulation Authority (APRA) has also issued similar warnings regarding AI risks for financial firms. ([fintech.global](https://fintech.global/2026/05/01/australian-regulator-flags-ai-risks-for-financial-firms/?utm_source=openai)) However, the lack of direct sourcing from ASIC’s original letter and the potential summarization of Bloomberg’s content reduce the overall credibility of the claims.
Overall assessment
Verdict (FAIL, OPEN, PASS): FAIL
Confidence (LOW, MEDIUM, HIGH): MEDIUM
Summary:
The article raises valid concerns about cybersecurity risks associated with advanced AI models like Mythos, aligning with industry discussions and warnings from regulators. However, the lack of direct sourcing from ASIC’s original letter, potential summarization of Bloomberg’s content, and the absence of independently verifiable quotes diminish the overall credibility and reliability of the information presented. These factors lead to a FAIL verdict with MEDIUM confidence.