The Australian Securities and Investments Commission (ASIC) has issued an open letter to financial licensees and directors calling for an “urgent” increase in cybersecurity measures to address the threat posed by AI tools.

While cyber threats have always existed, it said, misuse of frontier AI models could expose vulnerabilities at an unprecedented speed, scale and sophistication. The letter adds that while these models do not create entirely new categories of risk, they do mean existing controls are likely to be tested more often and under greater pressure.

The body specifically mentions misuse of Anthropic’s Claude Mythos model as a cause for concern, joining regulators in the UK, US and EU.

ASIC’s message, the letter says, is not to wait for “perfect clarity” to address the threat posed by new AI models. Instead, financial institutions should act with discipline to strengthen the cyber resilience fundamentals that underpin their businesses.

The letter sets out a comprehensive list of steps for institutions to take to enhance their cyber security, including the reassessment of cyber plans, reviewing and validating core controls and regularly reviewing user access.

While the expectations it lays out are not new, the letter warns that small weaknesses can now have serious, cascading consequences.

The letter also notes the AU$2.5 million fine ASIC issued to FIIG Securities in February after it was found to have failed to protect clients from cyber security failures. It says that the court’s judgement in this case lays out that risk management must be “demonstrably effective and proportionate to the size, nature and complexity of a business”.

“Cyber risk has entered a new era,” said Simone Constant, ASIC Commissioner. “The advent of frontier AI models creates opportunity, but also materially increases risk, with the ability to expose vulnerabilities far faster than many realise.

“In this new world, weaknesses that once seemed isolated can now have a system-wide domino-effect, enabling new forms of exploitation that were previously out of reach for most malicious actors.”

---