Banks and regulators around the world are racing to get controlled access to Anthropic’s new Claude Mythos model, an AI system that senior officials say is so good at finding software vulnerabilities that it could either harden the global financial system or help take it down. In the space of two weeks, Mythos has gone from an obscure “preview” model inside a research program to the focus of emergency calls between finance ministers, central bankers and CISOs, as banks scramble to use it defensively before criminals or hostile states can weaponize it.
What Mythos is, and why it matters
Mythos is Anthropic’s latest frontier‑class Claude model, built for advanced coding and “agentic” tasks, the ability to reason, write and execute code, chain tools, and autonomously pursue multi‑step goals. In internal and external evaluations, Mythos Preview has shown “strikingly capable” performance on computer‑security tasks, identifying bugs, and constructing working exploits at or above the level of top human specialists.
Crucially for banks, Anthropic and security researchers say Mythos can:
- Scan large, messy codebases and configuration files, not just toy examples.
- Discover unknown (“zero‑day”) vulnerabilities in major operating systems, web browsers and middleware.
- Generate functional exploit code, not just theoretical descriptions.
That makes it unlike typical “AI assistants” banks are piloting for call centers or document summarization. Mythos is explicitly about breaking software, and then, in the hands of defenders, fixing it before someone else breaks in.
Regulators quietly tell banks: test it
In early April, senior U.S. officials including Treasury Secretary Scott Bessent and Federal Reserve chair Jerome Powell convened top bank executives to brief them on Mythos and urge them to use it in controlled ways to probe their own systems.
According to reporting summarized by IndexBox and other outlets, the meeting’s message was blunt:
- Mythos and similar models can find software vulnerabilities at unprecedented speed and scale.
- Threat actors will eventually gain access to equivalent tools.
- Banks should deploy Mythos defensively now, under tight safeguards, to discover and patch weaknesses before attackers do.
The U.S. push has been mirrored in the UK, where regulators and the Financial Stability Board are gathering information on Mythos and sharing assessments with central banks and supervisors. The BBC reports that finance ministers and central bankers have held “emergency meetings” over Mythos after learning it had uncovered weaknesses in several major operating systems.
One Yahoo Finance write‑up says some Trump administration officials see a national‑security upside: getting large, complex financial institutions to harden their systems quickly using the best available AI, even as the administration fights Anthropic in court over other issues.
Early adopters: JPMorgan, Goldman, and big UK banks
Mythos is not being released to the open internet. Anthropic has limited the model to a small circle of “defensive security” partners as part of Project Glasswing, an initiative to use high‑end AI to find and fix vulnerabilities.
Those partners include:
- JPMorgan Chase – named as an initial banking partner with early access to Mythos Preview.
- Goldman Sachs, Citigroup, Bank of America, Morgan Stanley – evaluating or onboarding the technology.
- Major tech and security firms such as AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, Microsoft, Nvidia, Palo Alto Networks and the Linux Foundation, using Mythos to pound on core infrastructure.
Computer Weekly reports that leading UK banks have been told they will get access “next week,” and that their cyber teams are already on “red alert” to funnel Mythos findings into patch cycles. Anthropic has told them Mythos has already found vulnerabilities in every major operating system and web browser tested so far.
Internally, banks are building Mythos into controlled pipelines, feeding it mirrored copies of production code, infrastructure‑as‑code templates, and network diagrams, then triaging its output alongside conventional vulnerability scanners.
Why banks, specifically, are scrambling
Banks have two structural problems that make Mythos both attractive and alarming, as KPMG risk expert T.J. Marlin and other researchers told Reuters and elaborated on LinkedIn.
1. “Ancient technologies power the financial industry”
Core banking systems often run on decades‑old platforms, IBM mainframes, legacy Unix variants, and home‑grown COBOL, C and C++ code, with layers of newer microservices, web front ends and third‑party tools stacked on top. Traditional scanners struggle to see across this patchwork; Mythos, given access to code and configs, can trace vulnerabilities end‑to‑end through that stack.
2. Interconnected, high‑stakes networks
The banking sector is tightly coupled: payment rails, clearing houses, trading venues and custodians are all linked, often through aging APIs and shared vendors. A Mythos‑level exploit against a widely used component could propagate fast, turning a bug into a systemic event.
That combination is why the BBC, NYT and other outlets report finance ministers and central bankers expressing “serious concerns” that Mythos, in the wrong hands, could jeopardize financial stability.
The upside: automated red‑teaming at scale
For all the alarm, bank security chiefs also see Mythos as an unprecedented opportunity to automate red‑teaming and defensive testing.
In practice, that can mean:
- Pointing Mythos at core banking applications to identify privilege‑escalation paths, injection points and unsafe cryptography.
- Using it to test internet‑facing APIs and mobile apps, generating adversarial inputs that human testers would not think of.
- Running Mythos‑driven agents across infrastructure scripts (Terraform, Ansible, Kubernetes manifests) to catch misconfigurations that could expose internal services.
A Mirai Risk Technologies white paper argues that in balance‑sheet and risk management, Mythos‑class models can also help optimize ALM and liquidity by ingesting vast, siloed datasets and simulating complex interactions, although that’s a secondary use case compared with cybersecurity for now.
Executives quoted in Constellation Research and other industry notes say the near‑term goal is to let Mythos pound on their systems before attackers do, turning AI’s offensive capabilities into a defensive advantage.
The downside: weaponized AI and systemic risk
The flip side is clear: anything Mythos can do for defenders, a comparable model can do for attackers.
An investor trade group warned the U.S. Treasury in a recent letter that Mythos‑like tools could, in the worst case, lead to:
- Mass identity theft through large‑scale data breaches.
- Cascading outages of ATM networks, online banking, and payments.
- “Systemic financial market disruption” if critical infrastructure were compromised.
Security researcher Costin Raiu told one outlet that “a model like Mythos would have a field day” with IBM‑linked systems and other legacy components that underpin much of finance. A Reddit thread summarizing U.S. government warnings says Mythos has already uncovered “thousands of unknown (‘zero‑day’) vulnerabilities” across prominent operating systems and can craft full exploits, not just proofs‑of‑concept.
The Financial Stability Board has begun collecting data from its members on Mythos’s risk profile, intending to share insights so regulators can gauge the danger of autonomous, AI‑boosted cyberattacks on financial institutions.
Tight controls, legal fights, and ethical questions
Because of these concerns, Anthropic has restricted Mythos’s availability and framed Project Glasswing as a controlled experiment in “defensive‑first” AI release.
Key guardrails include:
- Limiting access to vetted partners (banks, cloud providers, security vendors) under contractual commitments to use Mythos only to harden their own systems.
- Logging and monitoring model interactions to detect prohibited uses.
- Coordinating disclosure of newly found vulnerabilities with vendors, so patches can be prepared before public advisories.
At the same time, Anthropic is in a legal dispute with the Trump administration, after the Department of Defense labeled the company a “supply‑chain risk” following failed talks over limits on US government use of its AI. That fight complicates the picture: some policymakers want banks to adopt Mythos for security, even as others seek to limit Anthropic’s role in sensitive infrastructure.
Ethicists also raise questions about “dual‑use” AI models, systems that are defensively valuable but inherently enable offensive capabilities, and whether existing export‑control and cybercrime laws are adequate for a Mythos‑level tool.
Why the scramble will continue
For bank CISOs and risk committees, the urgency around Mythos boils down to an uncomfortable truth: their attack surface is about to be scanned by AIs, whether they like it or not.
That’s why regulators are, paradoxically, pushing institutions toward a model that also scares them, effectively telling banks to race their own attackers.
Over the coming months, expect to see:
- More large banks quietly disclose Mythos pilot programs in their cyber and operational‑risk filings.
- Supervisors and the FSB publish initial guidance on AI‑driven red‑teaming, model‑risk management, and incident reporting.
- A parallel market of “Mythos‑like” models from other AI labs, raising the question of how to coordinate norms across vendors.
For now, the banking industry’s scramble for Mythos is both a bet and a defensive reflex: a bet that the best way to survive the next wave of AI‑powered cyber threats is to use the same class of tools, and a recognition that in a world where “ancient technologies power the financial industry,” it may take an AI to truly see where the cracks run.