UK banks blocked from cyber AI tool Mythos get offer from rival OpenAI

OpenAI has offered its advanced cybersecurity AI, GPT-5.5 Cyber, to nine major UK banks after rival Anthropic blocked them from accessing its comparable tool, Claude Mythos [1]. Both systems are designed to find hidden digital vulnerabilities. The AI Security Institute's report found both tools reached "a similar level of performance" in security testing tasks [1]. Anthropic had initially opened Mythos previews to a collective of 42 companies, mostly other US tech firms, and put $100m towards the effort [1]. OpenAI has taken a broader approach, offering access in the EU and to banks in Japan and Canada [1]. UK financial institutions, including Lloyds Banking Group, HSBC, and Nationwide, are now set to gain access to GPT-5.5 Cyber, while NatWest and Santander already have it under existing agreements [1]. Lloyds Banking Group is one of the UK's largest financial services organisations, with 30 million customers [2]. Such established banks sometimes face competition from newer challenger banks, which distinguish themselves through modern financial technology practices like online-only operations [3]. Charles Alan Nunn has served as chief executive of Lloyds Banking Group since August 2021 [4]. Bank of England governor Andrew Bailey recently warned UK banks were still unable to access Mythos to test their own systems [1]. Former UK Chancellor George Osborne, now a senior OpenAI executive, stated the firm does not want to "hide [5.5 Cyber] away" but confirmed it would not be available to all [1]. "We want to make sure that the forces that are establishing order in our democracies have these tools, and the forces that want to disrupt us or commit crime, do not," Osborne said [1]. Professor Alan Woodward, a cybersecurity expert from Surrey University, noted the tools' utility for examining legacy code. "In the UK, some of the code which banking systems still run on is incredibly old, and AI will be very useful at finding problems there," he said. "They can do many weeks' worth of work in minutes" but still require human verification due to false positives [1].