Asian banks tighten AI checks as frontier models heighten cyber risks

Banks across Asia are tightening internal checks on artificial intelligence as frontier models begin to blur the line between defensive testing and offensive cyber power. The sharpest concern is not only what AI can do today, but how quickly it could let attackers find weaknesses and scale intrusions before human security teams can respond.

That anxiety has been sharpened by Anthropic’s Claude Mythos Preview, a restricted-access cybersecurity model launched under Project Glasswing. Anthropic has described Project Glasswing as a defensive effort to secure critical software for the AI era, with launch partners including JPMorganChase, Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. The company has also extended access to more than 40 additional organizations tied to critical software infrastructure so they can scan and secure first-party and open-source systems. Anthropic says the model can identify and exploit zero-day vulnerabilities in every major operating system and every major web browser when directed to do so, and that it is not planned for general public release.

For banks, the lesson is that the same class of tools that can harden defenses can also accelerate attacks. Singapore’s biggest bank, DBS, said the technology amplifies risk by increasing both speed and scale for attackers. Tan Su Shan, chief executive and director of DBS Group, said the blast radius could be faster, while also arguing that AI remains a net positive because it improves coding and operations. DBS has already embedded AI across the organization, with hundreds of use cases deployed, and said the technology generated more than SGD 750 million in economic value in 2024.

Other lenders are responding by putting tighter gates around deployment. Oversea-Chinese Banking Corporation said its AI solutions undergo rigorous assessment and validation before deployment, while United Overseas Bank said it is using strict assessment, validation, cybersecurity controls and internal guardrails before rolling out AI tools. Standard Chartered chief executive Bill Winters called the new model a sensational illustration of rising cyber risk.

Regulators are trying to catch up, but the warning signs are growing. Australia’s prudential regulator, APRA, said on 30 April 2026 that governance, risk management, assurance and operational resilience practices were not keeping pace with the scale, speed and complexity of AI adoption. APRA said its warning followed a targeted supervisory review undertaken late last year and that it would keep assessing the implications for financial stability. In Singapore, the Monetary Authority of Singapore published an information paper on 5 December 2024 after a thematic review of banks’ AI and generative AI model-risk practices, setting out good practices for governance, risk management, development and deployment.

The pressure on banks is intensifying because the upside is so large. DBS reported first-quarter 2026 net profit of SGD 2.93 billion on 30 April 2026, after saying in full-year 2025 results that profit before tax reached SGD 13.1 billion and net profit SGD 11.0 billion. That combination of rising earnings and rising cyber exposure is forcing Asian banks into a new balance sheet reality: AI is now a productivity engine, a security tool and, increasingly, part of the battlefield.