This meeting aimed to ensure that all banks fully understand the potential risks posed by Mythos and similar models, and have implemented necessary system safeguards.
Author and source: Long Yue, Wall Street View
Anthropic's new AI model, Mythos, has raised serious concerns among U.S. regulators—two of America’s top financial regulators have jointly summoned the CEOs of Wall Street’s leading banks to Washington.
According to the latest report from Bloomberg, U.S. Treasury Secretary Bessent and Federal Reserve Chair Powell urgently convened CEOs of major Wall Street banks on Tuesday at the Treasury headquarters in Washington, with the central agenda being the potential cybersecurity threats posed by Anthropic’s new AI model, Mythos.
According to sources familiar with the matter, the meeting aimed to ensure that banks fully understand the potential risks posed by Mythos and similar models, and have implemented necessary system safeguards. A Treasury spokesperson did not immediately respond to requests for comment, and a Federal Reserve spokesperson declined to comment.
This meeting was arranged on short notice and had not been publicly reported beforehand, which in itself is a signal: regulators view novel cyberattacks as one of the greatest risks currently facing the financial industry. All invited banks have been designated as systemically important financial institutions by top regulatory authorities, whose stability is directly critical to the global financial system.
Who came, who didn't come
According to sources familiar with the matter, the bank CEOs attending the meeting included Jane Fraser of Citigroup, Ted Pick of Morgan Stanley, Brian Moynihan of Bank of America, Charlie Scharf of Wells Fargo, and David Solomon of Goldman Sachs. JPMorgan Chase CEO Jamie Dimon did not attend.
Spokespersons for various banks declined to comment, and a representative from Anthropic did not respond immediately.
This lineup nearly covers the largest systemically important banks in the United States. The regulators’ decision to engage directly with CEOs rather than technical or compliance teams underscores the urgency of this warning.
How dangerous is Mythos?
According to Anthropic, Mythos can, under user instruction, "identify and exploit vulnerabilities in every major operating system and web browser."
This means that if the model falls into the hands of malicious actors, its attack surface could encompass nearly all digital infrastructure. For banks that rely heavily on digital systems for operations, this is not an abstract risk—once core systems are compromised, disruptions to transactions, data breaches, and even systemic cascading effects could all occur.
Based on real-world data, Mythos’s capabilities are no exaggeration. According to a previous article by Wall Street View, the model discovered a 27-year-old remote crash vulnerability in OpenBSD and a 16-year-old vulnerability in FFmpeg that had been scanned over 5 million times by automated tools without triggering any alerts. Additionally, it autonomously chained together multiple vulnerabilities in the Linux kernel to construct a complete attack chain escalating from regular user privileges to full system control.
For this reason, Anthropic has adopted an extremely cautious release strategy, currently limiting access to a select few leading technology and financial institutions, including Amazon, Apple, and JPMorgan Chase. These organizations are jointly participating in the "Project Glasswing" initiative, aiming to proactively strengthen security for critical systems before similar AI models become more widely available. Anthropic stated that prior to its recent release, it engaged with U.S. officials to discuss Mythos’s "offensive and defensive cyber capabilities."
Too powerful to reveal publicly: The defender of "Project Glasswing" acted first
A Wall Street Journal article reported that on Tuesday, April 7, Anthropic announced the launch of Project Glasswing, an industry-wide initiative partnering with companies including Amazon, Apple, Microsoft, and Cisco to provide tools for scanning and remediating vulnerabilities in critical software infrastructure using its next-generation frontier model, Claude Mythos Preview.
Anthropic stated that, precisely because this model is so powerful, there are currently no plans to make it publicly available. In this context, Project Glasswing is positioned as a preemptive defense initiative, prioritizing its use for defensive purposes before similar capabilities become widely accessible.
Anthropic stated that it has maintained ongoing communication with U.S. government officials regarding its "offensive and defensive cyber capabilities" prior to the release of Mythos.
JPMorgan Chase's Chief Information Security Officer, Pat Opet, said the bank will evaluate the tool's value in defending financial critical infrastructure in a "rigorous, independent manner."
It is worth noting that Anthropic is currently involved in a legal dispute with the Trump administration. The Department of Defense has classified Anthropic as a supply chain risk, a designation Anthropic has challenged. This week, a federal appeals court denied Anthropic’s request to suspend this classification.
This context makes the relationship between regulators and Anthropic even more nuanced—on one hand, the Treasury and the Federal Reserve view its models as a systemic risk requiring urgent action; on the other hand, Anthropic still faces legal pressures at the governmental level.