Bessent, Powell met privately with top bankers over impact of Claude Mythos on cybersecurity

When Anthropic announced Project Glasswing on April 7, U.S. Treasury Secretary Scott Bessent and Federal Reserve Chair Jay Powell met privately with many of the top executives in banking to brief them on the power of Claude Mythos and its impact on banking security.

According to a report in Bloomberg, the top federal officials felt the need to make sure the banking CEOs understood the cybersecurity risks that Claude Mythos and other AI models presented to the financial system.

Already, security pros know that Claude Mythos represents a new level of AI capability in that it could detect a flaw that had been undetected for 27 years and could find “thousands” of zero-days in a matter of weeks.

“When the Fed Chair and Treasury Secretary pull the heads of America's largest banks into an urgent, unscheduled meeting about an AI model's cyber capabilities, that’s a financial stability signal,” said Jacob Krell, senior director, secure AI solutions and cybersecurity at Suzu Labs. “It tells us the risk assessment reached a threshold where the people responsible for the integrity of the U.S. financial system decided the industry needed to hear it directly and in person.”

Krell pointed out that U.S. banks operate some of the most mature and well-funded cybersecurity programs in the world. So, if the threat was severe enough to warrant this level of coordination for institutions that already invest billions in cyber defense, Krell said “every organization with a less mature security posture should pay very close attention.”

Bradley Smith, senior vice president and deputy CISO at BeyondTrust, said Glasswing will help defenders find and fix vulnerabilities faster than any human team – and that matters. But Smith said those who are presenting it as giving the “good guys” a head start mischaracterizes where we actually are.

“The adversary already has AI working for them,” said Smith. “State-sponsored and criminal threat actors are already using AI-augmented tooling to find and exploit vulnerabilities at a speed and scale that legacy defense postures cannot match. The starting gun fired before Mythos existed.”

Smith added that what Claude Mythos and Glasswing should signal to top leadership at companies is not reassurance, but urgency – and Smith said most organizations are not prepared to defend against the scale of the coming AI-driven attacks. 

“This is not a technology problem with a technology solution,” said Smith. “Glasswing helps find the bugs. It does not change the boardroom calculus that leaves organizations exposed and underinvested in the capabilities that actually matter. That will require courageous leadership, to recognize that there’s no head start. There’s only the decision to act or the decision to wait, and waiting has already cost the industry more than most leaders are willing to admit. Mythos will only increase that cost further.”

Sunil Gottumukkala, chief executive officer of Averlon, added that the real story here isn’t who gets access to Claude Mythos: it’s what happens after the critical bugs are found.

Gottumukkala said Claude Mythos represents a “step-function upgrade” in zero-day discovery, making it cheaper, faster, and more scalable. Even with restricted access, Gottumukkala said the industry should expect a surge in dangerous vulnerabilities across major platforms.

“Once patches are released, threat actors are often able to reverse engineer them and turn them into working exploits quickly,” said Gottumukkala. “That’s where the real impact shows up. Most organizations are still not equipped to respond at that speed. Teams need to up-level their remediation operations with continuous visibility into exposed assets, a clear understanding of likely attack paths, and the ability to mitigate risk at machine speed.”