US and UK regulators warn banks of Anthropic Mythos AI cybersecurity risks
US and UK regulators convened emergency meetings with major banks to warn of cybersecurity risks from Anthropic's Mythos AI model, which can autonomously discover and chain vulnerabilities. Anthropic restricted access to the model and said it consulted with the US government before release. Regulators encouraged banks to test it for defensive purposes while assessing systemic risks.
What happened
The US Treasury Secretary and Federal Reserve Chairman held emergency meetings with major Wall Street bank executives to discuss cybersecurity risks posed by Anthropic's Mythos AI model. Banks including JPMorgan Chase, Goldman Sachs, Citigroup, Morgan Stanley, Bank of America, and Wells Fargo were called to the meetings.
Mythos can autonomously identify and exploit vulnerabilities in mainstream operating systems and network browsers, including finding vulnerability chains that would be difficult for human hackers to discover and exploit simultaneously. The model demonstrated the ability to breach browser systems to read data from other websites.
The Bank of England and Bank of Canada announced plans to assess the model's cybersecurity implications with financial institutions in upcoming regulatory meetings.
Reported impact
Regulators identified next-generation AI-enabled cyberattacks as a major systemic risk to the global financial system. The rapid vulnerability discovery capability of the Mythos model could accelerate attack timelines and expand attack capabilities.
Experts warned that AI could enable hackers to disable financial systems, attack hospitals and manufacturing facilities, and compromise critical infrastructure including water treatment plants.
Index analysis
Anthropic restricted access to the model to a limited set of large technology and financial companies participating in Project Glasswing, which aims to harden critical infrastructure before broader release. The company stated it communicated with the US government about the model's offensive and defensive capabilities before release.
Governance controls
The US government confirmed it had evaluated the model and requested Anthropic delay public release pending completion of official review. Regulators encouraged banks to use the model's capabilities for vulnerability detection in their own systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.