Anthropic’s Mythos puts banks on notice as AI finds flaws faster

The new Reuters analysis on Anthropic’s Mythos turns an abstract AI-security argument into a banking problem. On April 13, Reuters reported that banks and regulators are already treating Mythos less as another model launch and more as an accelerator for vulnerability discovery across sprawling, mixed-age tech stacks. That distinction matters. Banks are not running clean greenfield systems; they are stitching modern cloud services to decades-old software, shared vendors, and regulatory workflows that can make one exploit echo across many institutions. The Reuters analysis is here.

According to Reuters, Anthropic says Mythos Preview can identify and exploit previously undiscovered vulnerabilities across every major operating system and every major web browser. The company’s researchers wrote that the model found “thousands” of high and critical-severity vulnerabilities, including a 16-year-old flaw in FFmpeg and a bug in an unnamed virtual machine monitor. That is the sort of finding rate that changes the security conversation from “can AI help attackers?” to “how many legacy systems can defenders realistically patch before the next search cycle runs again?”

The banking angle is especially sharp because the sector is interconnected and standardized in all the wrong places. Reuters quotes security and banking experts warning that many firms depend on the same narrow set of vendors for onboarding, KYC checks, and transaction handling. A model that can move quickly across those common surfaces does not just raise the odds of one breach; it raises the odds of replicated failure. Reuters also reports that officials in the U.S., Canada, and Britain have met with banking leaders about the threat, and that the U.S. Treasury expects more meetings.

Anthropic says Mythos Preview will not be generally available and instead is being tested through Project Glasswing with organizations including JPMorgan. That may limit immediate misuse, but it does not erase the signal. The signal is that frontier model capability is starting to outrun the patch cycle inside critical infrastructure. For banks, the real question is no longer whether AI-assisted discovery is coming. It is whether shared vendors, aging systems, and slow remediation workflows can survive a world where vulnerability hunting is cheap, fast, and increasingly automated.