Powell, Bessent Warn Banks About Anthropic Mythos Risks

Federal Reserve Chair Jerome Powell and Treasury Secretary Scott Bessent met with chief executives of Citigroup, Bank of America, Wells Fargo, Morgan Stanley and Goldman Sachs earlier this week in Washington to warn that Anthropic’s Mythos AI can identify and exploit software and browser vulnerabilities.

Officials told bank leaders that in testing the model autonomously located thousands of previously unknown flaws, including zero-day vulnerabilities across major desktop and mobile operating systems and popular web browsers. Draft materials about the model leaked in March and revealed what Anthropic describes as its most capable system to date.

Anthropic confirmed the model, called Claude Mythos Preview, and has limited access while it evaluates potential misuse. The company is running Project Glasswing, a collaboration with technology and security firms that uses the system to find and patch critical software vulnerabilities before attackers can exploit them.

Anthropic researchers said the model’s ability to find flaws emerged from broader improvements in coding, reasoning and autonomy rather than targeted training. In a safety report the firm wrote, “The same improvements that make the model substantially more effective at patching vulnerabilities also make it substantially more effective at exploiting them.”

Powell and Bessent urged banks to review cyber defenses, increase monitoring, harden software environments and work closely with vendors and cybersecurity teams to detect and remediate vulnerabilities that could be discovered or exploited by advanced AI tools.

Security researchers and industry participants have noted that automated vulnerability discovery can speed defenders’ work and lower the cost and time needed for attackers to weaponize findings. Anthropic says it is testing Mythos in controlled settings with a limited set of partners and will not release the model to the public for now.

Bank executives left the meeting with guidance to reassess exposure to AI-driven cyber threats and to coordinate with federal agencies and industry partners on defensive measures. Regulators are monitoring developments as advanced AI systems demonstrate capabilities that can outpace traditional security controls.