Regulators can't keep up with Claude

On April 12, 2026, Reuters broke the news that British financial regulators were holding emergency talks over Anthropic's Claude Mythos Preview. The Bank of England, the Financial Conduct Authority, and HM Treasury pulled in the National Cyber Security Centre and summoned executives from major banks, insurers, and exchanges for urgent briefings. It was the first time a single AI model release triggered a cross-agency scramble in a major financial center. The same week, Canadian bank executives and regulators met to discuss the same model. The US Treasury Secretary and Fed Chair pulled bank CEOs into an unscheduled session. Across three continents, financial regulators were reacting to a technology release the way they normally react to market crashes. This wasn't a drill. And it won't be the last time it happens.

The model that broke the playbook

Claude Mythos Preview is, by Anthropic's own admission, both the "best-aligned model ever" and the one posing the "greatest alignment-related risk ever." The model autonomously discovered thousands of zero-day vulnerabilities across every major operating system and web browser. It found a 27-year-old bug in OpenBSD's TCP SACK implementation, a 16-year-old vulnerability in FFmpeg's H.264 codec that survived five million hits from automated testing tools, and independently chained together several Linux kernel vulnerabilities to escalate from ordinary user access to complete system control. Anthropic chose not to release it publicly. Instead, through Project Glasswing, they shared it with a select group of partners, including Amazon, Apple, Microsoft, JPMorgan Chase, and CrowdStrike, to help harden their defenses before attackers gain access to similar capabilities. The cybersecurity implications are staggering. But the regulatory implications might be even more important.

The speed gap

Here's the core problem: AI model releases happen on the scale of weeks. Regulatory responses happen on the scale of months to years. And that gap is widening, not closing. The EU AI Act, the most ambitious attempt at comprehensive AI regulation, was proposed in April 2021. It entered into force in August 2024. Full compliance for high-risk systems isn't required until August 2026, over five years after the initial proposal. In that time, the AI landscape has transformed beyond recognition multiple times over. The UK has taken a deliberately lighter approach, relying on existing sector-specific regulators rather than creating new legislation. The idea was that this would be more agile. But when Claude Mythos dropped, those same regulators had to scramble for emergency meetings because they had no framework for assessing a model that could autonomously compromise the financial infrastructure they're supposed to protect. A parliamentary Treasury Select Committee warned in January 2026 that the UK financial system "may not be prepared enough for major AI-related incidents." Two months later, they got their proof.

The safety lab paradox

What makes this story particularly striking is that Anthropic has positioned itself as the safety-first AI company. They pioneered Constitutional AI. They published their Responsible Scaling Policy. They chose not to release Mythos publicly precisely because of its risks. So why is the "safety lab's" model the one triggering regulatory panic? Because safety and capability are not opposites. They're deeply correlated. The same improvements in coding, reasoning, and autonomy that make Mythos better at patching vulnerabilities also make it better at exploiting them. Anthropic acknowledged this directly: "We did not explicitly train Mythos Preview to have these capabilities. Rather, they emerged as a downstream consequence of general improvements." And the safety track record for frontier models isn't exactly reassuring. Independent evaluations from SPLX AI found that Claude Opus 4.1, the previous top-tier model, scored just 53% on security benchmarks with a basic system prompt. Prompt hardening pushed that to 87%, but the baseline tells a story: out of the box, even the "safety lab's" models leave significant gaps. Mythos is dramatically more capable, which means the stakes of those gaps are dramatically higher.

Regulators always one crisis behind

This pattern has a precedent. After the 2008 financial crisis, regulators scrambled to address risks they'd failed to anticipate: excessive leverage, opaque derivatives, interconnected counterparty exposure. The Dodd-Frank Act didn't pass until 2010, two years after the crisis. Basel III wasn't fully implemented until years later. The regulatory response was thorough, but it was designed for the last crisis, not the next one. The same dynamic is playing out with AI, only faster. Jamie Dimon warned in early 2026 about parallels between AI-driven risk concentration and pre-2008 conditions. The UK Treasury Select Committee found "worrying" evidence of unpreparedness. And yet the regulatory toolkit remains largely unchanged: principles-based guidance, sector-specific reviews, and consultation papers that take months to produce. The financial sector is particularly vulnerable because it sits at the intersection of two exposures. First, AI models like Mythos can directly threaten financial infrastructure through cybersecurity exploits. Second, the financial sector's increasing reliance on a small number of US technology firms for AI and cloud services creates systemic concentration risk. If a frontier model can compromise the infrastructure that banks depend on, the blast radius extends far beyond any single institution.

The Singapore question

Not every jurisdiction is responding the same way. Singapore has maintained a voluntary, sector-specific approach to AI governance, favouring guidelines over legislation and emphasizing speed of adoption over comprehensive regulation. The logic is straightforward: heavy regulation slows innovation, and in a competitive global landscape, falling behind on AI adoption carries its own risks. Singapore's Ministry of AI has focused on building human resource capability, developing ecosystems, and publishing advisory frameworks rather than binding rules. Is this better or worse than the UK's approach? In some ways, it's more honest. Singapore's framework acknowledges that regulators can't keep up with the pace of change and doesn't pretend otherwise. Instead, it bets on agility and course-correction. The risk is that "course-correction" might come too late if a Mythos-class model is deployed irresponsibly within financial systems before guidelines catch up. The EU, meanwhile, has gone the other direction entirely with the AI Act, creating a comprehensive risk-based framework with mandatory compliance requirements. But comprehensiveness comes at the cost of speed, and the AI Act was arguably outdated before it was fully implemented. There's no obviously correct answer. Each approach trades off different risks against different benefits. What's clear is that none of them were designed for a world where a single model release can trigger emergency meetings across three countries in a weekend.

Can regulation even work at this speed?

This is the uncomfortable question at the heart of the Mythos story. The traditional regulatory model, where governments identify risks, draft rules, seek public comment, and enforce compliance, assumes a pace of change that allows deliberation. AI development doesn't offer that luxury. Consider the timeline. Mythos was first leaked in late March 2026 through an accidental data exposure. Anthropic confirmed its existence the same day. Project Glasswing launched on April 7. By April 12, regulators across the UK, Canada, and the US were in emergency talks. That's less than three weeks from leak to regulatory scramble, and the model hasn't even been publicly released. Traditional regulation can't move that fast. No consultation period, impact assessment, or parliamentary debate can match the pace of a frontier lab shipping a model that fundamentally changes the threat landscape. Some observers have proposed alternatives: mandatory pre-release safety evaluations, AI model licensing regimes, or international coordination bodies modeled on nuclear non-proliferation treaties. These ideas have merit, but they all share the same fundamental challenge. They require institutions that move slowly to govern technology that moves fast.

The market might get there first

Here's a pragmatic take: the market will likely self-regulate through liability and insurance before governments catch up. HSB, a subsidiary of Munich Re, launched AI liability insurance for businesses in March 2026, covering bodily injury, property damage, and advertising injury from AI systems. Multiple US states have introduced bills in 2026 that would expand liability for AI-related damages. Courts are beginning to grapple with who bears responsibility when autonomous AI agents cause harm. These aren't theoretical discussions. When a model can autonomously find and exploit vulnerabilities in every major operating system, the liability implications for any company deploying it, or failing to defend against it, are enormous. Insurance companies are very good at pricing risk, and they're moving faster than regulators to put frameworks in place. This doesn't mean regulation is unnecessary. Liability and insurance create incentives, but they don't set floors for acceptable behavior. They don't prevent catastrophic one-off events. And they favor well-resourced organizations that can afford coverage over smaller players and open-source maintainers who can't. But as a practical matter, the insurance market's response to AI risk may end up shaping corporate behavior more than any regulatory framework, simply because it moves at the speed of business rather than the speed of government.

What comes next

The Mythos episode won't be an isolated incident. As frontier models continue to advance, we'll see more cases where a single release forces regulators into reactive mode. The question isn't whether to regulate, the concern is legitimate and the risks are real, but whether regulation can be designed to work at the speed that matters. The financial sector will likely be the canary in the coal mine. It's heavily regulated, deeply interconnected, and now directly in the crosshairs of AI capabilities that didn't exist six months ago. How regulators, companies, and insurers respond to the Mythos moment will set the template for how the world handles the next one. The storm isn't coming. As cybersecurity expert Alissa Valentina Knight put it, "the storm is here." The question is whether we're building shelters or still debating the building codes.