Bank cyber teams on red alert as Anthropic promises them Mythos next week

Vulnerabilies everywhere

White added that Mythos found vulnerabilities in every single operating system and in every single web browser. “We wanted to build this small cohort first, basically learn from what they found in a very contained and controlled manner,” she said. “But our intention is definitely to expand this out in a very intentional way.”

UK financial services firms are yet to be involved, but this is about to change. “I think that is in the very near term, like in the next week,” said White.

Mythos hit the headlines this week when UK banks were called in by regulators as the model identified thousands of software vulnerabilities.

The company announced Project Glasswing to enable organisations to develop defences against its misuse.

Mythos’s ability to identify security flaws in software which have remained undetected for years, despite organisations such as banks constantly looking for them, is a warning of what AI in the wrong hands could do. 

White said Anthropic has been in contact with banking leaders this week. “As you would expect, the engagement that I’ve had from CEOs in the last week in the UK has been significant,” she said. “Customers firstly want to say that they appreciate our very thoughtful approach to the way in which we have released Mythos. But secondly, of course, they want to understand the opportunity to be considered to gain access to that model in a controlled way.

“And so, we’ve been having a lot of conversations with CEOs about the reason why, firstly, we did Project Glasswing, and the way that we thought about that intentionally.”

Badly needed

In a blogpost, benchmarking firm Evident, which tracks financial services AI adoption, wrote: “Banks have gotten a head start testing Mythos, the new cybersecurity model from Anthropic it deemed too dangerous to release to the public. What the lenders that have access are finding so far shows just how badly they needed it.”

 “This is hardly the first time a new model has rocked the enterprise, but top regulators didn’t haul bank executives in for emergency meetings when GPT-5 got released last summer,” said Evident in its blog post. “The fear with Mythos is it can turn anyone into the best hacker banks have ever seen – not just because it can sniff out weaknesses in decades-old software that have evaded human detection, but because it can generate the code that lets them exploit it automatically.”

One IT professional in the banking sectore said: “I think they have been given a chance to find and fix their own vulnerabilities before this technology gets in the hands of the bad guys. They have been given a window to clean up their shops ahead of wider release.”