Anthropic Mythos raises alarm over AI-driven bank cyberattacks

Banks are being pushed to treat advanced AI as a near-term cyber risk, not a distant one. Anthropic says Claude Mythos Preview is its most capable frontier model yet, and that it can identify and exploit zero-day vulnerabilities in every major operating system and every major web browser when directed to do so.

That matters most for financial firms because their defenses are only as strong as their weakest connection. A typical bank runs a dense stack of customer onboarding tools, identity checks, payment systems, transaction-monitoring software and vendor integrations, often on top of aging legacy systems that were never designed for AI-assisted attacks at machine speed. Anthropic says the model has already found thousands of high-severity vulnerabilities, including a now-patched 27-year-old OpenBSD flaw, and that more than 99% of the vulnerabilities it discovered remained unpatched.

The warning has already reached top policymakers and bank executives. Scott Bessent and Jerome Powell held an urgent meeting with bank CEOs to discuss cyber risks tied to Anthropic’s latest model, while Kevin Hassett said the administration wanted banks to understand the threat and harden their systems. Jamie Dimon was unable to join that session. In Canada, the Bank of Canada and major lenders met through the Canadian Financial Sector Resiliency Group, involving the six largest domestic banks, as the Office of the Superintendent of Financial Institutions said it was in active conversations with institutions to raise awareness and assess the effect on financial-system resilience.

Anthropic has not released Mythos publicly. Instead, it launched Project Glasswing on April 7 as a defensive-security effort built around the model. The initiative brings together Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks as launch partners, with access extended to more than 40 additional organizations that build or maintain critical software infrastructure. Anthropic said it is committing up to $100 million in usage credits and $4 million in donations to open-source security groups.

The company says the goal is to help the industry prepare for a coming wave of AI-driven attacks while the tools remain limited to a narrow set of defensive users. For banks, the message is direct: the exposure is not only in the model itself, but in the age of the systems it can probe, the speed of response those systems require and the vendor chains that can turn one weakness into a broader breach.