On Tuesday, Reuters reported that the new artificial intelligence (AI) model Claude Mythos Preview, unveiled by AI company Anthropic, is sending shockwaves through the global financial system and cybersecurity landscape.
Mythos has demonstrated an unprecedented ability to autonomously identify unknown software vulnerabilities (zero-days) and generate attack code, surpassing top human experts. This development has prompted governments and financial authorities in the U.S., U.K., and Canada to take extraordinary measures, including emergency meetings with Wall Street’s top executives.
Last week, an urgent, unannounced meeting took place in Washington, D.C. U.S. Treasury Secretary Scott Vessenet and Federal Reserve Chair Jerome Powell summoned Chief Executive Officers (CEOs) from leading Wall Street institutions, including JP Morgan Chase and Goldman Sachs Group, Inc. The government-initiated gathering aimed to convey the grave threat Mythos poses to the foundations of the U.S. financial system.
Mythos is far more than a code-writing AI. It possesses sophisticated agent capabilities, enabling it to set its own objectives, analyze systems for weaknesses, and design complex attack strategies by linking various vulnerabilities. In Anthropic’s internal tests, Mythos uncovered thousands of previously unknown zero-day vulnerabilities across major operating systems and web browsers.
The AI’s prowess was further demonstrated when it discovered a critical flaw that had lurked undetected for 16 years in the widely-used open-source video processing program FFmpeg. It also unearthed a 27-year-old bug in OpenBSD, an operating system renowned for its robust security.
The U.K.’s AI Safety Research Institute (AISI) validated Mythos’s capabilities through independent evaluation, recognizing it as the first AI model to autonomously execute a complex 32-stage simulated corporate network hack from start to finish.
This capability is particularly alarming for the financial sector. In a Reuters interview, TJ Marlin, CEO of corporate AI security firm Guardrail Technology, highlighted the vulnerability of banks due to their complex mix of cutting-edge and legacy systems.
Naresh Raheja, a former consultant with the Office of the Comptroller of the Currency (OCC), warned of a potential domino effect, noting that most banks rely on solutions from the same vendors, making a single breach potentially catastrophic.
Acknowledging the gravity of the situation, Anthropic has opted not to release Mythos publicly. Instead, they’ve launched Project Glasswing, a defensive initiative.
Major financial institutions including JP Morgan Chase, Goldman Sachs Group, Inc., Citigroup, and Bank of America have joined this project. They’re leveraging Mythos from a defensive standpoint to proactively identify vulnerabilities in their systems.
While Project Glasswing aims to buy time for defenders to stay ahead of potential attackers, experts caution that the duration of this grace period remains uncertain.
The U.S. response has triggered swift action from other major nations.
In Canada, AI Minister Evan Solomon met directly with Anthropic executives, while the Bank of Canada held strategy sessions with major commercial banks. The U.K.’s financial regulators are preparing urgent meetings with bank leaders, underscoring that the Mythos Shock has escalated into a global security concern.