What You Need to Know — and Do — Now
Frontier AI capabilities can now weaponise IT weaknesses in “a matter of minutes or hours,” the European Systemic Risk Board warned this week when it elevated the status of systemic cyber risk to “severe.” This warning aligns with other recent regulatory announcements, including a joint statement last month by the Five Eyes cybersecurity agencies that AI is accelerating the speed, scale and sophistication of cyber threats and may transform offensive and defensive capabilities in a matter of months, not years.
Most recently, the European Central Bank sent a letter on 7 July 2026 to key lenders in the eurozone warning that the financial services sector needed to produce comprehensive action plans addressing AI-driven cyber risk by the end of October — the most prescriptive response yet by any major central bank to the AI-charged cybersecurity threat.
The release of Anthropic’s Claude Mythos Preview in April 2026 ushered in a new reality where the window between vulnerability disclosure and active exploitation is no longer weeks or months, but potentially minutes. Anthropic identified that its new model was capable of autonomously discovering zero-day vulnerabilities and writing code to exploit them at superhuman speeds. Regulators today are increasingly focused on the potential risks and harms that these advanced AI models may facilitate. For all commercial organisations, this evolution presents an immediate escalation in legal risk, regulatory exposure, and organisational liability that demands urgent attention.
This article sets out the nature of the new AI-driven threat environment, examines its implications for legal and compliance functions, and provides practical guidance on the steps organisations should be taking now — and planning for in the months ahead.
To read the full Ropes & Gray alert, click here.