Anthropic's Mythos AI model has sent U.S. banks into a scramble to address a wave of IT system vulnerabilities the tool has surfaced, triggering emergency remediation efforts and stoking concern about potential service interruptions, according to Reuters.
Several of the biggest U.S. banks are among those with direct access to Mythos and are actively working to address the flaws it uncovers, Reuters reported, drawing on unnamed sources with knowledge of the situation. Findings from those big lenders are being shared downstream with community and regional banks that have no access to Mythos, giving those institutions a chance to shore up their defenses in advance.
The volume of weaknesses Mythos is surfacing ranges from several hundred to thousands, most of them rated low to moderate in severity, Reuters reported. The pace of required remediation is also accelerating sharply: fixes that banks might previously have deferred for weeks are now being completed within days. The heavier remediation workload raises the prospect of more frequent system outages, though Reuters reported that lenders are expected to schedule any downtime carefully to limit its impact on customers.
Among the capabilities drawing the most attention is the model's knack for linking a series of individually minor flaws into a combined exploit that carries much greater risk. Mythos has also shown a strong facility for detecting weaknesses across both internally developed and open-source software, forcing banks to confront long-deferred decisions about retiring legacy systems whose vendor support has lapsed, Reuters reported.
CrowdStrike $CRWD's Adam Meyers, who oversees counter adversary operations at the firm — a Project Glasswing participant — recalled to Reuters that his team's initial days with Mythos were consumed not by hunting bugs but by figuring out how to use the tool at all, describing "a solid entire weekend trying to figure out how to best use this thing before we even started looking for bugs." His gut reaction when he first heard about Mythos, he said, was simply "oh boy."
For smaller institutions, Mythos remains out of reach on two fronts: price and infrastructure. The model carries a price tag of $25 per million input tokens and $125 per million output tokens, making it five times more expensive than Opus 4.7, the Anthropic model available to a broader market, Reuters reported. To ease the cost burden, Anthropic has pledged $100 million in usage credits to Glasswing partners and other qualifying Mythos customers, and has separately published guidance for organizations that have no access to the model at all.
When Anthropic launched Mythos, it channeled access through Project Glasswing, a controlled rollout that included JPMorgan $JPM Chase, Amazon $AMZN Web Services, Apple $AAPL, Broadcom $AVGO, Cisco $CSCO, CrowdStrike, Google $GOOGL, the Linux Foundation, Microsoft $MSFT, Nvidia $NVDA, and Palo Alto Networks $PANW as named partners. Reuters, citing sources and company executives, also reported that Goldman Sachs $GS, Citigroup $C, Bank of America $BAC, and Morgan Stanley $MS are among those with access.
The model's arrival has drawn scrutiny from across the financial and regulatory establishment. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell convened an urgent meeting with bank CEOs to discuss the cybersecurity risks Mythos poses, with those present including Citigroup CEO Jane Fraser, Morgan Stanley CEO Ted Pick, Bank of America CEO Brian Moynihan, Wells Fargo $WFC CEO Charlie Scharf, and Goldman Sachs CEO David Solomon.
Defense comes later, offense comes first — that was essentially the message from JPMorgan Chase CEO Jamie Dimon, who has acknowledged that AI is currently widening companies' exposure to cyberattacks before it can be harnessed to protect them, according to CNBC.
Nitin Seth, who co-founded the data and AI services company Incedo and serves as its CEO, framed the moment in stark terms for Reuters: "This is a wake-up call because cyber risk is moving to machine speed, while much of bank defense still operates at human speed."