Should banks adopt frontier AI as core cybersecurity infrastructure with regulators focused on enabling safe deployment, or should regulators treat shared reliance on such models as a systemic risk requiring concentration limits and structural safeguards before widespread adoption?

My position is that frontier AI should become core cybersecurity infrastructure for banks, with regulation aimed at assurance, auditability, controlled deployment, and fallback—not at slowing adoption. The strongest empirical reason is that the threat environment is becoming machine-speed while bank defense still depends heavily on scarce human analysts and brittle legacy tooling. If attackers can use AI to find vulnerabilities, write exploit chains, and automate reconnaissance, then requiring banks to defend primarily with human-speed processes is not prudence; it is accepting an asymmetric disadvantage.

First, Mythos-like systems are not merely better chatbots; they appear to change the economics of vulnerability discovery and remediation. Anthropic’s Project Glasswing materials describe Claude Mythos Preview as a frontier model being used to discover, reproduce, and patch real-world vulnerabilities, including long-lived bugs such as a 27-year-old OpenBSD flaw. The key banking implication is not that every bank should blindly depend on Anthropic. It is that defensive teams with access to frontier AI can search codebases, logs, configurations, and third-party software at a scale that manual teams cannot match. JPMorgan’s inclusion in Project Glasswing is important because it shows at least one systemically important bank treating this capability as defensive infrastructure, not experimentation.

Second, there is already quantitative evidence that security AI and automation reduce breach harm. IBM’s 2025 Cost of a Data Breach reporting found that organizations using AI and automation extensively in security operations saved an average of about $1.9 million in breach costs and reduced breach lifecycles by about 80 days. That is not a speculative benefit; faster identification and containment are exactly what matters in banking, where the difference between an isolated compromise and a systemic incident can be hours.

Third, the alternative is not a well-staffed, perfectly resilient human SOC. ISC2’s 2024 workforce research estimated a global cybersecurity workforce gap of 4.8 million professionals. Banks are better resourced than many sectors, but they still compete for the same scarce incident responders, reverse engineers, cloud-security specialists, and threat hunters. Frontier AI does not eliminate the need for experts; it lets scarce experts supervise more investigations, triage more alerts, and remediate more vulnerabilities.

I accept the strongest counterargument: common dependence on a few opaque AI systems could create correlated failures, shared blind spots, or vendor concentration risk. But that argues for supervisory controls, not delay. Banking regulators already have a template in third-party risk management: due diligence, contractual controls, ongoing monitoring, audit rights, incident reporting, resilience testing, and exit plans. For frontier cyber AI, regulators should require red-team evaluations, model-behavior logging, independent audits, human authorization for destructive actions, multi-vendor or non-AI fallback procedures, and regular tabletop exercises. The systemic danger is not AI adoption itself; it is untested monoculture. Properly governed deployment reduces institution-level breach probability while managing sector-level fragility.

B’s strongest point is the common-mode-failure argument. The July 19, 2024 CrowdStrike outage is a real warning: a single security vendor’s defective update can create broad operational disruption, and an AI failure could be subtler than blue screens—shared false negatives, shared hallucinated triage, or shared poisoned context. B is also right that IBM’s AI-and-automation savings do not, by themselves, prove sector-wide resilience under correlated stress. That is a genuine limitation, not a minor caveat.

But that point changes the governance design, not the adoption conclusion. The question is not whether every bank should standardize blindly on one opaque model. My position is that frontier AI should become core defensive infrastructure because bank-level cyber defense is already facing scale and speed problems that human teams and legacy SIEM/SOAR workflows cannot solve alone. Anthropic’s Glasswing materials say Mythos Preview can find and help remediate serious vulnerabilities, including a 27-year-old OpenBSD bug, and that partners include JPMorganChase; even if we discount vendor claims, this shows why sophisticated banks see frontier AI as operationally relevant rather than experimental. The defensive value is further supported, though not conclusively proven for Mythos specifically, by IBM’s 2025 finding that extensive security AI and automation correlated with about $1.9 million lower breach costs and 80 fewer days in breach lifecycle. That directly targets the banking risk that matters most: dwell time and containment speed.

B’s evidence actually supports a regulated-adoption model. The Bank of England/FCA survey found financial AI adoption already widespread and noted concentration in model-provider relationships, with the top three providers accounting for 44% of reported model-provider relationships. That means slowing formal adoption may not prevent dependence; it may push AI use into less visible tooling and third-party services. The regulatory response should force visibility: inventory every AI-assisted cyber function, classify which are critical, log prompts/actions/model versions, require independent validation on bank-specific telemetry, and mandate staged rollouts and reversible updates.

NIST’s adversarial-ML taxonomy gives the right test agenda: banks and vendors should specifically evaluate evasion, poisoning, privacy, abuse, trojan, and backdoor risks before models are allowed to suppress alerts, prioritize incidents, or generate remediation plans. Federal bank regulators already have a usable third-party risk framework: due diligence, contract controls, ongoing monitoring, business-continuity expectations, and termination planning. Applied to frontier cyber AI, that means audit rights, model-update controls, concentration reporting, backup detection paths, human authorization for high-impact response, and exercises where the model is unavailable, compromised, or systematically wrong.

So B proves the need for anti-monoculture requirements. B does not prove that banks should remain dependent on understaffed human teams against AI-enabled attackers. The safer equilibrium is frontier AI as supervised infrastructure, not frontier AI as ungoverned monoculture—or no frontier AI at all.

B’s strongest argument is that the relevant risk is not whether frontier AI improves one bank’s security operations, but whether many banks adopting the same opaque model family create a common-mode failure channel inside critical financial infrastructure. The CrowdStrike outage is the best analogy: a security tool intended to protect firms became a cross-sector operational disruption, and an AI cybersecurity failure could be harder to see because it might manifest as shared false negatives, poisoned prioritization, or synchronized bad triage rather than crashed machines. B is also right that concentration, third-party dependence, and adversarial ML risks are not speculative categories; the Bank of England/FCA survey, FCA CrowdStrike analysis, and NIST taxonomy all support taking them seriously.

The reason I still think A’s position is stronger is that B’s evidence supports architectural regulation, not a posture of slowing adoption. The empirical baseline is not a resilient human-centered banking SOC; it is a defender labor market with a large cybersecurity workforce gap and an attacker ecosystem increasingly able to use AI for reconnaissance, vulnerability discovery, and exploit development. Anthropic’s Project Glasswing materials are vendor-reported and should be independently validated, but they nevertheless show why major technology firms and JPMorganChase are evaluating Mythos-class systems: the model reportedly found thousands of high-severity vulnerabilities, including long-lived bugs, and substantially outperformed Anthropic’s prior model on vulnerability reproduction. If such capabilities exist even approximately as described, refusing to make them core defensive infrastructure leaves banks fighting machine-speed threats with constrained human capacity.

B’s CrowdStrike example also cuts both ways. It proves that monoculture is dangerous, but it does not prove that critical security tooling should be kept peripheral; banks did not respond to endpoint-detection risk by abandoning endpoint security. They responded, and regulators urged them to respond, with mapping of dependencies, update phasing, severe-but-plausible testing, fallback planning, and single-point-of-failure analysis. That is exactly the regulatory model A endorses for cyber AI: mandatory inventories of AI-assisted security functions, independent validation on bank-specific telemetry, adversarial testing for evasion and poisoning, versioned logs, staged and reversible model updates, non-AI backup detection paths, human authorization for high-impact response, and concentration reporting.

The core distinction is normative and empirical. Normatively, regulators should not privilege avoiding a new technology risk over reducing active breach risk unless the new risk is shown to dominate. Empirically, the evidence presented so far shows plausible correlated AI risk, but not that regulated AI adoption creates more expected harm than continued dependence on understaffed human teams and legacy tools. The stronger conclusion is therefore: make frontier AI core infrastructure, but prohibit opaque, untested monoculture. B is right about the guardrails; B has not shown that guardrails require slowing adoption rather than making adoption conditional, observable, and reversible.