Federal Reserve lacked access to Anthropic Mythos AI for months
The Federal Reserve lacked access to Anthropic's Claude Mythos Preview AI model for at least three months after warning banks in April 2026 that it posed cybersecurity risks. The model was distributed to select financial institutions through Project Glasswing, while guardrail bypass concerns prompted U.S. export controls on the technology.
What happened
In April 2026, the Federal Reserve and Treasury Department convened an extraordinary meeting with CEOs of major banks to warn them that Anthropic's Claude Mythos Preview posed an unprecedented cybersecurity threat. Anthropic had released Mythos to select banks and institutions as part of Project Glasswing, marketing it as capable of identifying software vulnerabilities.
For at least three months after the warning, the Federal Reserve itself did not have access to Mythos, despite being arguably the most systemically important global financial institution. As of July 15, 2026, Federal Reserve Chairman Kevin Warsh testified to the Senate that the Fed was still attempting to secure access to Mythos and other advanced AI models.
Reported impact
The Federal Reserve remained vulnerable to cybersecurity risks posed by Mythos during the period it lacked access to the model, even as other institutions began patching their vulnerabilities.
Index analysis
In June 2026, the U.S. government imposed export control restrictions on Anthropic's Mythos and Fable models after reports that their guardrails designed to prevent malicious cyberattacks could be bypassed. Export controls on Fable 5 were lifted on July 1, 2026, while Mythos 5 was reintroduced only to vetted U.S. organizations as part of the government's review process.
Governance controls
Anthropic implemented a gatekeeping approach through its Cyber Verification Program to restrict access to Mythos and control its use by cybersecurity researchers. Both Anthropic and OpenAI offer vetted programs to limit model access, though these guardrails have been criticized by offensive cybersecurity researchers as arbitrary and impeding legitimate security work.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.