Anthropic and Mythos: How a Danger to Banks Quickly Became a Risk for Everyone

Anthropic brought Mythos to market as a model that is dangerous to release publicly, and in doing so moved the AI conversation from "is it more convenient to work with?" to "will we be able to defend ourselves in time?" At first glance, the alarm looks like a story only about banks: after the announcement, US Treasury Secretary Scott Bessent gathered Wall Street executives and demanded they make sure their systems are ready for a new wave of cyber risks. But the most uncomfortable conclusion is a different one: if even organizations with the best-protected IT environments in the world are nervous about such a model, the threat is higher still for thousands of ordinary companies.

From the description and first assessments, Mythos does differ from familiar mass-market models such as ChatGPT or Gemini specifically in cyber scenarios. The research the source material cites shows the model is better suited to complex attacks and is especially dangerous for simplified, "poorly protected" systems. Access is being sought not only by large companies but also by government bodies: the UK AI Security Institute is mentioned among the first organizations with access, and the US Treasury is also pushing to be connected. The very fact of such interest shows this is no longer about demonstrating the power of yet another AI, but about a tool that can change the balance between attack and defense.

The problem comes down to the old model of responding to vulnerabilities. For years the market ran on responsible disclosure: a vendor finds a hole, publishes details, releases a patch, and customers calmly test the update and roll it out across their infrastructure. Microsoft turned this into a regular process known as Patch Tuesday. In large banks such as Barclays or Wells Fargo, fixes go through a long route: review, approval, risk assessment for live systems, and only then deployment. This worked before because attackers also needed time to study a bug description, devise a way to exploit it, and bring the attack to working condition.

Generative AI, and then agentic models, began to break this logic. A system can now not only read vulnerability publications but also search for similar weak spots in open code on its own, try out hacking options, and chain several minor flaws into one multi-step attack. As a result, the window for defense shrinks sharply. According to zerodayclock.com, the average time between discovering a vulnerability and a working exploit appearing has fallen from 771 days in 2018 to under four hours now.

This is where it becomes clear why the panic around Mythos should not be limited to Wall Street. "Black hat" hackers have never been especially keen to go after banks, with their high level of control and multi-layered defenses. It is far more profitable to attack hospitals, contractors, regional services, or a small shop with a poorly configured infrastructure and demand a ransom.

If models like Mythos lower the barrier to entry for such attacks and speed up their preparation, the main risk zone shifts to where there are fewer people, less budget, and almost no time to react. The story also adds to the aura of Anthropic itself as the company that first publicly marked a new threshold of danger.

The main question now is not who exactly gets access to Mythos, but whether the old pace of cyber defense is still viable. If only hours remain between disclosure of a vulnerability and a real attack, monthly patch cycles start to lose their meaning. Banks may be able to move to near-continuous updating, automated verification, and tighter change management. Small and medium-sized businesses will have a much harder time without cheap protection services, new requirements for suppliers, and, probably, regulatory help.

That is why Mythos matters not as yet another sensational model but as a warning: the era in which weeks and months were allowed for fixing bugs is ending.