American Banker: Bank prudential regulators House testimony: Live coverage

Foster underscores risks of artificial intelligence on cyber, runs

Rep. Bill Foster, D-Ill., pressed officials on the cybersecurity risks posed by Anthropic's Mythos model, which he said has already identified more than 10,000 "high-and-critical level security flaws in otherwise trusted software."

Foster questioned whether only large global systemically important banks, or G-SIBs, and major institutions are getting early access to Mythos, while smaller banks and regional lenders are left to deal with weaker cyber defenses. 

"It's unquestionably true that small banks with their private systems have not been given the same level of cyber defense that the large ones have — which is not irrational, but it seems to me that you're going to need a very clear position on this," Foster said. 

He argued the government should define a standardized, defensible "software stack" for the financial system so regulators can prioritize consistent protection across institutions.

"You're going to have to define the defensive position perimeter and say this is a software stack that we're going to defend to the best of our abilities," Foster said. "Other institutions that are using different software stacks are going to have to just accept that there's lesser priority."

Regulators largely declined to disclose which institutions have access to Mythos or in what proportion. Gould echoed concern about the uneven security landscape and said they are focusing on third-party vendors that support smaller banks.

"I'm also concerned about the perception of a cyber moat, again, real or perceived, around the very largest banks, and I think, particularly around the smaller banks, as well as midsize and regionals," Gould said. "It's very important for us to focus on the service providers that support them."

Foster also warned that autonomous AI systems operating at machine speed could trigger financial runs in seconds rather than hours, suggesting the 2023 bank failures could have been exponentially faster if agentic artificial intelligence had been deputized to run at the first sign of failure. 

"I don't think that we are prepared for agentic AI bank run. … If you look at what happened in Silicon Valley, and then ask yourself the question, what would have happened in the world where agentic finance makes things happen not at the speed of internet gossip [but] at the speed of agentic AI, that would have caused the run to take not 40 hours, but 40 minutes or 40 seconds," Foster said. "We are not ready for that, and you should come up with a plan to deal with that, because we can have that hearing now, or we can have it later."