The AI Cyber Arms Race in Banking: Why Legacy Systems Put GCC Banks at Greatest Risk

The warning did not come from a cybersecurity researcher or a government agency. It came from the chief executive of one of the world's largest banks, speaking at the highest level of global financial governance.

C.S. Venkatakrishnan, CEO of Barclays, addressed the G30 consultancy group on the sidelines of the International Monetary Fund's spring meeting in Washington on Friday and his message to the room of central bankers and finance ministers was unambiguous: Mythos is a serious issue, but the greater danger is what follows it.

"There Will Be a Mythos 2 and a Mythos 3"

Venkatakrishnan's remarks went beyond an assessment of Anthropic's current model. His concern was structural the trajectory of AI capability development and the speed at which successive models will continuously raise the threat ceiling for the global banking sector.

"But here's the thing: there will be a Mythos 2 and a Mythos 3, and they'll come up with probably distressing frequency," he said.

This framing resets the stakes of the current Mythos debate. The question for financial institutions is no longer how to respond to a single model. It is how to build security architecture capable of keeping pace with a continuous escalation cycle an AI-driven arms race in which offensive capability advances faster than legacy defensive infrastructure can adapt.

Legacy Systems and the Amplified Risk for Larger Institutions

Venkatakrishnan was direct about where the greatest vulnerability concentrates. Such technological leaps, he said, will be especially challenging for older and larger institutions running legacy systems precisely the profile that cybersecurity experts and regulators have identified as the GCC banking sector's most acute exposure.

The intersection of rapid digital transformation and decades-old core infrastructure a defining characteristic of major GCC banks operating under Vision 2030 and the UAE's national digitalisation agenda places the region's financial institutions squarely in the category Venkatakrishnan identifies as highest risk.

"We have to understand its capabilities and we have to understand how to safeguard against it," he said.

Regulators in Scramble Mode

The Barclays CEO's remarks reflect a broader shift in how global financial governance is responding to Mythos. Regulators and supervisors across multiple jurisdictions are now in active review mode, with selected organisations granted access to the model specifically to assess real-world cybersecurity risk. Officials in the United States, Canada, and the United Kingdom have already held emergency-level meetings with senior banking executives.

For GCC financial regulators including SAMA, the UAE Central Bank, and financial supervisory bodies in Qatar and Kuwait this international regulatory mobilisation is a direct signal to act. No GCC-equivalent emergency briefings have been publicly announced to date.

What GCC Security Leaders Must Take From This

The Barclays CEO's intervention at a G30/IMF forum carries specific weight for enterprise security leaders across the region. This is not a vendor warning or a research paper. It is the CEO of a Tier 1 global bank, confirming in the most authoritative forum available that the threat is real, structural, and accelerating.

GCC CISOs should treat Venkatakrishnan's arms race framing as a strategic planning mandate not just a headline. If Mythos 2 and Mythos 3 arrive with the frequency he describes, institutions that have not rebuilt their threat modelling frameworks around AI-native attack patterns will face compounding exposure with each new iteration. For a practical framework on where to start, see what GCC CISOs must do now in response to AI-driven vulnerability exploitation.

The arms race Venkatakrishnan describes demands a continuous, AI-native security posture not point-in-time assessments.

Why This Matters Globally

The Barclays CEO's statement at the IMF spring meeting marks a turning point in how the global financial establishment is publicly framing the AI cyber threat. For the first time, a major bank CEO has moved the conversation from assessing a single dangerous model to naming a permanent new condition one defined by continuous AI capability escalation and a structural gap between offensive AI tools and the legacy defensive infrastructure of the world's largest financial institutions.

For every bank globally and particularly for the GCC's rapidly digitising financial sector the implication is the same: the institutions that invest in AI-native security architecture today are building resilience not just against Mythos, but against every iteration that follows it.

Frequently Asked Questions

What does an AI cyber arms race mean for global banking institutions?
As AI capabilities accelerate, financial institutions face a continuously evolving threat landscape where offensive tools advance faster than legacy defensive infrastructure can adapt. This creates compounding risk for larger banks running older core systems.

Why are legacy banking systems most at risk from AI cyber models?
Legacy core systems contain decades of undiscovered vulnerabilities across patched integrations, undocumented APIs, and ageing middleware. AI models capable of autonomous vulnerability discovery can systematically map and exploit these weaknesses at machine speed far faster than human security teams can detect and respond. Institutions running hybrid legacy-and-modern stacks face the highest concentration of structural risk.

What should GCC banks and CISOs do in response to the AI cyber arms race? GCC financial institutions should move beyond point-in-time security assessments toward continuous, AI-native threat modelling. Immediate priorities include AI-assisted vulnerability scanning of legacy infrastructure, review of shared vendor dependencies for systemic exposure, and proactive engagement with regulators including SAMA and the UAE Central Bank for emerging AI-risk guidance.

* This article is a speculative analysis and does not describe real events, real products, or real executive statements. It is intended as a thought exercise on AI-driven cyber risk in the financial sector.