Anthropic's Mythos AI model raises cybersecurity concerns among US regulators
Anthropic announced Claude Mythos, an AI model described as exceptionally capable at discovering cybersecurity vulnerabilities and chaining them into attack sequences, prompting urgent meetings between US financial regulators and major banks to discuss potential risks to financial system stability. The company restricted access to the model through a limited partnership program rather than public release, citing dual-use concerns about its powerful vulnerability detection capabilities.
What happened
Anthropic announced Claude Mythos, an AI model capable of discovering thousands of cybersecurity vulnerabilities rapidly, reportedly with advanced capabilities to chain vulnerabilities together into complete exploit chains.
US Treasury Secretary Scott Biesent and Federal Reserve Chair Jerome Powell held closed meetings with leaders of major US banks including JPMorgan Chase, Goldman Sachs, Bank of America, Citigroup, and Morgan Stanley to discuss potential cybersecurity risks posed by the model.
Anthropic initially limited access to Mythos, with JPMorgan Chase as the sole institution with direct access as a pilot partner, while other major financial institutions began pilot testing. Access restrictions were justified by the model's advanced vulnerability detection capabilities despite not being specifically trained for cybersecurity purposes.
Reported impact
The UK Artificial Intelligence Safety Institute described Mythos as more capable of cyberattacks than any previously evaluated model, capable of analyzing legacy operating systems, browsers, and infrastructure simultaneously.
Financial institutions and regulators expressed concern that accelerated computational capabilities could compress the response time for defending against attacks, as traditional security patch timelines may become insufficient.
Index analysis
Advanced frontier AI model capabilities reportedly double every four months according to official British assessments, creating regulatory and security challenges as vulnerability discovery moves from human to automated processes.
The incident highlights tensions between using AI to accelerate cybersecurity defenses versus risks of misuse, with potential leaks of these capabilities to malicious actors representing an unprecedented threat.
Governance controls
The US administration discussed and supported emergency shutdown mechanisms and governance frameworks for AI systems in relation to financial stability and national security.
Anthropic restricted distribution of Mythos through its Glasswing project to specified partners including major technology companies and sensitive infrastructure institutions, rather than public release.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.