Earlier this month, Anthropic introduced Mythos, an AI model that it said excels at uncovering and exploiting software vulnerabilities. (Credit: SEBASTIEN BOZON)
The emergence of Anthropic PBC’s Mythos is a signal point for the financial system to “put on our thinking caps and our glasses” to understand what risks artificial intelligence poses, says the country’s top banking regulator.
The industry needs to “really understand what’s coming at us, because it’s coming at us pretty fast,” Peter Routledge, head of the Office of the Superintendent of Financial Institutions (OSFI), said at an event on Tuesday.
He also said neither OSFI nor banks can tackle those risks alone.
“It’s got to be a shared effort,” he said.
Earlier this month, Anthropic introduced Mythos, an AI model that it said excels at uncovering and exploiting software vulnerabilities. The tool is supposedly so powerful that the company has declined to release it to the public. The fear is that if the tool falls in the wrong hands, there could be a massive increase in cyber risk.
Routledge’s comments mark a slight shift in tone for OSFI. Over the past two years, the regulator focused on understanding AI rather than regulating it.
“I sort of said, ‘It’s too early to jump into regulation and our first principle should be to do no harm and enable institutions to innovate with AI,’” he said. “We approached (AI) with a healthy restraint.”
Canada’s financial sector, especially the Big Six banks, has experimented with AI and looked for ways to use it to boost productivity.
For example, Canadian Imperial Bank of Commerce said AI helped it save 1.2 million hours of work during its first quarter, while Toronto-Dominion Bank said AI allowed it to cut reviews of its mortgage approval process to minutes from hours.
But the emergence of Mythos doesn’t mean OSFI is going to “surrender” its “do-no-harm principle,” Routledge said, but he wants financial institutions to be better aware of the potential risks of AI and Mythos.
“How serious Mythos is, how serious a threat it is, we still have a cycle to go through to truly understand that,” he said.
Routledge said he wants board members and senior managers to meet quarterly to price in “the severity of the risk” and develop defences. He also said there will have to be a public-private sector approach to tackle this risk.
“It’s very conceptual,” he said. “We just haven’t gotten into the details of how to build those defences and what our role, or other institutions in the public sector, might have to do.”
Still, Routledge said he is optimistic the sector can strengthen its safeguards in a “healthy amount of time.”
OSFI’s annual risk outlook, which was released earlier this month, didn’t focus on Mythos, but on the risks related to the residential housing market, non-banking financial institutions and liquidity, but that’s because it was drafted in January.