Global Bank Regulators Raise Alarm Over Cybersecurity Risks From Anthropic's Mythos AI Model

Anthropic has introduced Claude Mythos, also known as Fable 5, touting stronger code-analysis and vulnerability-detection capabilities. Such models can help defenders patch smart contracts but may also lower the technical barriers to launching cyberattacks, fueling concerns in the crypto community about the security of assets and protocols.

Anthropic said the new model includes general-purpose safety safeguards and routes cybersecurity-related queries to a specialized model to reduce the risk of misuse. The Uniswap founder, however, criticized the design of its “safety filter” as poorly calibrated. Related reports did not disclose the exact release date, any losses or the value of assets affected.

Anthropic is targeting Japan’s cybersecurity market with its next-generation AI model Claude Mythos, focusing on vulnerability detection and pursuing Japanese government agencies and financial institutions. The strategy raises questions about cross-border reliance on critical computing power and cybersecurity capabilities. It has also drawn the U.S. government’s attention to computing sovereignty, prompting Japan to accelerate development of advanced domestic cybersecurity models.

As of July 20, 2026, the latest reports indicate that Anthropic is aggressively positioning itself in Japan’s government and financial markets, with Claude Mythos’s vulnerability-detection capabilities emerging as a key competitive focus. The Japanese government and industry are simultaneously advancing the development of sovereign models. Available information does not disclose the model’s release date, investment amount, procurement scale or any formal partner institutions.

macOS isolates applications through kernel permissions and multiple layers of security. If those protections are bypassed, attackers could gain elevated system privileges. Cybersecurity research firm Calif combined Anthropic’s internal Mythos AI model with human experts to analyze the system, underscoring generative AI’s growing ability to tackle complex vulnerability research.

In 2026, Calif’s team had Mythos identify a way to bypass macOS security protections and uncover a privilege-escalation vulnerability within five days. The flaw was subsequently designated CVE-2026-28952 and affects the macOS 26.5 kernel. Apple has received the report and begun verification, while the related acknowledgments also credit Anthropic’s Claude with discovering the vulnerability.

Anthropic’s Mythos AI model is positioned as a system with advanced cybersecurity capabilities. But its powerful offensive and defensive tools could also be misused, drawing scrutiny from the European Commission and financial regulators. Anthropic has pledged to comply with the EU’s AI Code of Practice, assess the model’s risks and take steps to mitigate them.

EU officials have now met with Anthropic for a briefing on cybersecurity concerns surrounding Mythos, while euro-area finance ministers have separately raised requirements concerning bank access. Available information does not disclose the exact date of the meeting, the number of banks affected or any transaction amounts. Attention will now turn to access permissions and risk-control standards.

JPMorganChase CEO Jamie Dimon said Anthropic's Claude Mythos generative AI model can identify software vulnerabilities faster than existing tools, potentially strengthening both defensive capabilities and attacks. Because large banks share numerous open-source components, a single vulnerability could spread across the financial system, making the issue a significant risk.

Speaking recently at an Anthropic event, Dimon described Mythos as “very high risk” and urged major banks, including JPMorganChase, to work together to identify and patch vulnerabilities in the open-source software they share. He also expects generative AI and traditional software to coexist over the long term, rather than AI replacing conventional software entirely. Reports did not disclose the event's exact date, quantitative risk data or any financial amounts involved.

Anthropic’s new Claude Mythos model has demonstrated a strong ability to identify software vulnerabilities. It could help companies and researchers patch systems, but could also be misused to rapidly find weaknesses and expand cyberattacks. The issue is shaping the direction of U.S. AI regulation and testing the balance between model innovation and national cybersecurity.

The White House is concerned that Claude Mythos could be used in large-scale cyberattacks, according to the latest reports. The Trump administration is considering moving away from its relatively hands-off stance and requiring new AI models to undergo government security reviews and standardized testing before release. No implementation date, thresholds, responsible agency or related budget has been announced.

Banks often layer new services onto legacy systems that have operated for years, while widely sharing account-opening, KYC and trading software. If an LLM capable of finding vulnerabilities across systems were misused, an attack could spread rapidly from a single institution through the financial system. The U.S. Treasury and Federal Reserve, the U.K.’s National Cyber Security Centre, and Canada’s Department of Finance and Bank of Canada have therefore identified Claude Mythos as a cybersecurity concern.

Anthropic unveiled Claude Mythos Preview on April 7, 2026. An April 13 assessment by the U.K. AI Security Institute found that it achieved a 73% success rate on expert-level capture-the-flag challenges and completed all 32 steps in three of 10 enterprise attack tests. OpenAI expanded access applications for GPT-5.4-Cyber on April 14, adding malware analysis and binary reverse engineering. No financial amounts were involved or disclosed.

Anthropic plans to offer its Mythos AI model to British banks as part of an expansion of “Project Glasswing.” Mythos is designed to identify vulnerabilities in cyber defenses, helping financial institutions uncover attack surfaces earlier. Because banks hold large volumes of sensitive data, model security and the risk of false positives are particularly important.

Anthropic recently said it was ready to offer Mythos to British banks, but as of July 20, 2026, it had not disclosed the participating banks, deployment date, contract value or pricing model. The model’s release was previously delayed for safety testing, and the initiative signals that the company is moving ahead with real-world deployment in the financial sector.

Banks are elevating generative AI from an automation tool to a core productivity and revenue strategy, even as models could accelerate the discovery and exploitation of software vulnerabilities. Anthropic has therefore withheld Claude Mythos Preview from public release. For major banks such as Morgan Stanley, which manages about $1.6 trillion in assets, balancing efficiency, cybersecurity and workforce adjustments has become a central governance issue.

On April 15, 2026, Morgan Stanley CEO Ted Pick told a first-quarter earnings call that “AI is our friend” and confirmed the bank had been approved to use the Mythos preview. JPMorganChase is also testing it. A March survey of 206 banking professionals found that at least half considered AI a high priority, while most institutions had increased AI spending by at least 10% over the previous 12 months. Bank of America, meanwhile, has made AI available to 200,000 employees.

Anthropic’s latest AI model, Claude Mythos, has demonstrated advanced offensive and defensive cyber capabilities, raising cybersecurity concerns across the financial system. Banks operate critical infrastructure spanning payments, clearing and cross-border fund flows. If the model were used to automatically uncover vulnerabilities or launch attacks, risks could spread rapidly from a single institution through the global financial network.

As of July 19, 2026, US Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell had convened the chief executives of several systemically important banks for emergency talks, calling on them to assess Mythos-related threats and strengthen their defenses. Regulators in three countries — the United States, the United Kingdom and Canada — were also evaluating the risks, while the US Treasury was separately seeking access to the model.