Loading story…
U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell reportedly convened an urgent meeting with chief executives from major Wall Street banks to warn that Anthropic’s new AI model, Mythos, could accelerate the discovery and exploitation of previously unknown software flaws. The discussions included leaders from systemically important institutions such as Citigroup, Morgan Stanley, Bank of America, Wells Fargo, and Goldman Sachs, reflecting concern that advanced offensive cyber capabilities could create not only enterprise security problems but broader financial-stability risks.
Anthropic has described Mythos as a model built for cybersecurity software engineering that can identify vulnerabilities across major operating systems, web browsers, and other software, and in some cases help assemble sophisticated exploits. The company did not broadly release the model, instead limiting access under Project Glasswing to roughly 40 technology firms including Microsoft and Google, while briefing U.S. officials and industry stakeholders on its risks and defensive uses. Officials are also weighing the implications for crypto and DeFi platforms, where low-cost, real-time zero-day discovery could increase the threat of disruptive attacks.
Track how attackers are adapting to this technology.
19 events from the most recent confirmed update back to the earliest known activity.
The House Committee on Homeland Security was set to receive a closed-door briefing from Anthropic on Mythos covering the model's cyber capabilities, national security implications, and policy considerations. The meeting reflected growing congressional scrutiny of the model's potential to both accelerate vulnerability discovery for defenders and enable offensive cyber misuse.
Japan announced a public-private working group to address cybersecurity risks to the financial system associated with Anthropic's Mythos model. The Financial Services Agency said 36 entities, including major banks, the Bank of Japan, and the Japanese units of Anthropic and OpenAI, would examine vulnerability handling, defensive measures, contingency planning, and cross-border information sharing.
Australia’s corporate regulator, the Australian Securities and Investments Commission, warned financial services organizations to urgently improve cybersecurity against risks from frontier AI systems such as Anthropic’s Mythos. ASIC said preparedness varies widely across the sector and cautioned that AI-enabled cyber risks can emerge far faster than traditional risk timelines, potentially allowing rapid weaponization of vulnerabilities.
India’s Securities and Exchange Board of India issued an advisory urging equities-market participants to urgently review cybersecurity posture due to risks that Anthropic’s Mythos could accelerate cyberattacks. SEBI also established a taskforce to assess AI-related cyber risks, share threat intelligence, review third-party software vendors, and guide defensive measures across the securities industry.
The Trump administration was reportedly considering a 16-page executive order to establish technical guidelines and best practices for securing advanced and open-weight AI models, driven in part by cybersecurity and national security concerns raised by Anthropic's Mythos. Officials were also said to be exploring a larger intelligence-community role in defending systems against advanced AI threats.
Australian banks were reported to be on edge over Anthropic's Mythos model and rushing to identify and fix cybersecurity weaknesses it could expose. The development marked the spread of banking-sector concern over Mythos to Australia, beyond earlier responses in the U.S., U.K., and Germany.
Federal CIO Greg Barbaccia said the Office of Management and Budget has started preparing for a controlled rollout of Anthropic's Mythos model to U.S. agencies in coordination with the Office of the National Cyber Director. He said no federal agencies had deployed Mythos yet and that the government remained in an early evaluation phase, with some agencies seeking access while CISA had not received it.
Anthropic was reported to be investigating claims that unauthorized users may have gained access to its restricted Mythos model. The company had not identified any malicious use at the time, but the inquiry suggested possible leakage beyond the tightly controlled access program.
Bundesbank President Joachim Nagel warned that Anthropic's Mythos could pose major cybersecurity risks to banks because of its ability to rapidly identify and exploit software vulnerabilities. He argued that access should be broadened to all relevant institutions to avoid competitive imbalances and reduce the risk of misuse by a limited group of actors.
Regulators in Asia reportedly increased scrutiny of banks amid fears that Anthropic's Mythos model could expose or accelerate exploitation of cybersecurity weaknesses in financial systems. The move marked a further regional expansion of official oversight beyond earlier actions in the U.S., U.K., and Germany.
During the IMF and World Bank spring meetings in Washington, senior international financial officials including IMF Managing Director Kristalina Georgieva, ECB President Christine Lagarde, Bank of England Governor Andrew Bailey, and Canada's finance minister warned that emerging AI models could expose structural weaknesses in global banking and payment systems. The discussion highlighted fears that models such as Anthropic's Mythos could accelerate vulnerability discovery and exploitation faster than regulatory safeguards can adapt.
Anthropic CEO Dario Amodei was reportedly scheduled to meet White House Chief of Staff Susie Wiles as U.S. officials assessed the national security implications of the Mythos model. The engagement reflected federal concern that Mythos's vulnerability-discovery capabilities could aid both defensive remediation and offensive cyber operations.
German banks and financial authorities began examining the cybersecurity risks posed by Anthropic's Mythos model to the banking sector and legacy systems. The German Banking Association said it was consulting member-bank cyber experts along with Germany's finance ministry, the Bundesbank, and BaFin on preparedness for newly discovered vulnerabilities.
The British government issued an open letter urging businesses to strengthen baseline cybersecurity, improve executive accountability, and prepare for AI-accelerated vulnerability discovery and exploitation following concern around Anthropic's Mythos model. The warning cited a U.K. AI Security Institute evaluation that found Mythos more capable at cyber offense than any model the institute had previously assessed, while noting significant testing limitations.
Goldman Sachs said it is testing Anthropic's restricted Mythos model with Anthropic and security vendors to better understand emerging AI-enabled cyber risks and improve defenses. The bank also said it is accelerating investment in cyber and infrastructure resilience as concern grows over Mythos's offensive capabilities.
British financial regulators, Treasury officials, and the National Cyber Security Centre reportedly began urgent discussions with major banks to assess cyber risks linked to Anthropic's Claude Mythos Preview. The review focused on vulnerabilities the model could expose in critical IT systems, extending official concern beyond the earlier U.S. response.
U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell reportedly held an urgent Washington meeting with CEOs from major Wall Street banks to warn them about cyber risks tied to Mythos and similar AI systems. The discussion focused on ensuring systemically important banks understood the threat and were taking defensive measures against potential AI-enabled cyber incidents.
Around the time of launch, Anthropic briefed U.S. government officials and industry stakeholders on Mythos's offensive and defensive cybersecurity capabilities. The company also said it consulted U.S. officials before release because the model could identify critical bugs and help assemble sophisticated exploits.
Earlier in the week before April 10, 2026, Anthropic launched its new AI model Mythos but did not broadly release it because of concerns it could uncover previously unknown cybersecurity vulnerabilities. Access was reportedly limited under Project Glasswing to about 40 technology companies, including Microsoft and Google.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
40 references tracked. Mallory keeps watching after this page renders.
thehill.com
Open sourceteiss.co.uk
Open sourcescworld.com
Open sourceteiss.co.uk
Open sourceamlintelligence.com
Open sourceteiss.co.uk
Open sourcecoindesk.com
Open sourceqz.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Anthropic restricted public release of its **Mythos** AI model after internal and external testing showed unusual strength in software vulnerability research, including the ability to analyze code, identify previously unknown flaws, and assess likely exploitability. The company said the concern was not the usual set of AI risks such as misinformation or hallucinations, but the possibility that advanced models could sharply accelerate vulnerability discovery and reduce a longstanding bottleneck in cyber operations. A U.S. official told the Associated Press that, during joint testing with U.S. intelligence agencies under Anthropic’s **Project Glasswing**, Mythos identified vulnerabilities in highly sensitive U.S. government systems within hours. Senator Mark Warner later said at a Senate hearing that the tool had broken into almost all classified systems within hours, citing information attributed to NSA and U.S. Cyber Command leadership, while Anthropic and outside experts argued the model’s capabilities could help defenders patch systems faster even as they raise the risk of faster exploit development and weaponization.
Jul 12, 2026
Anthropic unveiled **Claude Mythos Preview**, an unreleased AI model it says can autonomously discover and exploit severe software vulnerabilities across major operating systems, browsers, open-source projects, and some closed-source targets. The company said the model uncovered thousands of high-severity flaws, including long-lived bugs in **OpenBSD**, **FFmpeg**, Linux kernel privilege-escalation chains, and **`CVE-2026-4747`**, a FreeBSD NFS remote code execution flaw that could enable unauthenticated root access. Anthropic withheld broad release, citing offensive cyber risk, and instead launched **Project Glasswing**, a gated program for roughly 40 to 50 partners such as AWS, Apple, Cisco, Cloudflare, Google, JPMorgan Chase, Microsoft, Mozilla, NVIDIA, and Palo Alto Networks to validate findings, patch affected software, and study defensive uses. Independent and industry assessments broadly agreed Mythos marks a significant advance in AI-enabled cyber capability, though several researchers questioned how much of Anthropic’s headline claims can yet be verified through public CVEs and warned that similar results may be reproducible with cheaper or open models plus strong tooling. The UK AI Security Institute found Mythos achieved a **73%** success rate on expert capture-the-flag tasks and completed a full 32-step simulated enterprise attack in 3 of 10 runs, while Anthropic later reported coordinated disclosure activity spanning **1,596 vulnerabilities across 281 open-source projects** and partners identifying more than **10,000** high- or critical-severity candidates. Governments, financial regulators, and CISO groups in the US, UK, Europe, Canada, and Japan responded with briefings and warnings that AI is compressing the gap between vulnerability discovery and weaponization, leaving remediation, patch governance, and defensive automation as the main bottlenecks.
Aug 31, 2026
Anthropic’s **Claude Mythos Preview** has been rolled out to a limited set of major technology and infrastructure firms under **Project Glasswing**, where partners including Amazon, Apple, Microsoft, Cisco, CrowdStrike, Palo Alto Networks, Broadcom, and the Linux Foundation are using it for defensive security work such as vulnerability discovery in first-party and open-source software. Anthropic said the model found **thousands of high-severity and zero-day vulnerabilities**, while Mozilla reported Mythos identified **271 Firefox flaws**, far above the 22 bugs previously found with an earlier Anthropic model. Mozilla said the findings suggest AI-assisted code reasoning is approaching the breadth of elite human vulnerability research, even if the bugs themselves were still understandable to human experts. Separate findings from the UK’s **AI Security Institute (AISI)** indicate that frontier models’ autonomous cyber capabilities are advancing faster than earlier forecasts and that common evaluation methods may be understating their performance. AISI reported the `80%`-reliability cyber time horizon has been doubling every **4.7 months** since late 2024, with Claude Mythos Preview and `GPT-5.5` outperforming that trend, and said Mythos became the first model to complete both evaluated enterprise cyber ranges, including the previously unsolved industrial-control scenario **Cooling Tower**. AISI also found that larger inference budgets—up to **50 million tokens** or **1,000 turns**—unlock materially higher success rates on difficult cyber tasks, reinforcing concerns that increasingly capable AI systems could strengthen defenders while also lowering the barrier to advanced offensive cyber operations if access is not tightly controlled.
Jun 29, 2026