By Maksym Misichenko · CNBC ·
What AI agents think about this news
The panel consensus is that the Fed's lag in accessing Anthropic's Mythos model poses a significant risk to financial sector cybersecurity resilience, with potential information asymmetry and regulatory arbitrage concerns. However, the exact nature and severity of the risk remain debated.
Risk: Regulatory lag and potential information asymmetry due to banks withholding zero-day findings from the Fed.
Opportunity: Accelerated AI governance and treasury-bank coordination to address the identified risks.
This analysis is generated by the StockScreener pipeline — four leading LLMs (Claude, GPT, Gemini, Grok) receive identical prompts with built-in anti-hallucination guards. Read methodology →
In April, the Federal Reserve and Treasury Department convened an extraordinary meeting with the CEOs of the nation's top banks. Officials rang the alarm bell about an advanced new artificial intelligence model that could pose an unprecedented cybersecurity threat to the nation's top financial institutions.
Anthropic, the company behind the AI model, Claude Mythos Preview, said the offering excelled at identifying weaknesses and security vulnerabilities within software. The company released it to a select group of banks and other institutions as part of a cybersecurity initiative called Project Glasswing.
For at least three months afterward, the Fed itself didn't have access to Mythos, leaving arguably the most systemically important global financial institution vulnerable, even as other institutions began to patch their weaknesses.
The Fed was still trying to get access to Mythos as of July 15. It isn't clear if the central bank has since gained access to the model.
Anthropic didn't immediately respond to a request for comment. The Fed declined to comment for this article.
The meeting in April happened under the previous leader of the Fed, Jerome Powell, who convened bank CEOs alongside Treasury Secretary Scott Bessent, as CNBC reported earlier**.** But in little-noticed congressional testimony last week, Powell's successor, Chairman Kevin Warsh, told the Senate he was still working to secure access to Mythos and other cutting-edge AI models.
"We are not the deciders as to who has access, but I have not been shy in sharing my views with authorities across the government about the vulnerabilities, and have been asking for access not just for the Federal Reserve but for other institutions to a whole range of these new artificial intelligence models so that they can protect themselves," Warsh told Sen. Jack Reed, D.-R.I., in response to questions about Mythos.
Warsh clarified that there were other models the Fed needed access to as well.
"I wouldn't want to just isolate Mythos, though," Warsh said. "As these new models find their way more broadly, our banking system and frankly, the Federal Reserve needs to do all we can to patch any vulnerabilities that we have."
Warsh has embraced the adoption of AI in his brief time at the Fed, calling it a transformational technology.
It isn't clear the work to address vulnerabilities can begin without access to Mythos.
Anthropic unveiled Claude Mythos Preview and Project Glasswing in early April.
The company said roughly 50 organizations had access to the model at the time, but it named only a handful, including the bank JPMorgan Chase, and tech titans such as Amazon, Apple and Google. Anthropic said it had also been in "ongoing discussions with U.S. government officials" about the model, including the Cybersecurity and Infrastructure Security Agency and the Center for AI Standards and Innovation.
Anthropic expanded access to Project Glasswing in June, adding more than 150 organizations to the initiative across 15 countries. Daniel Newman, CEO of research firm the Futurum Group, said he was surprised to hear the Fed was not included.
"You would think that the financial institution that sort of drives all the policy for the rest of the financial institutions would be front and center of at least having a chance to evaluate the new technology," he told CNBC on Tuesday.
Mythos' rollout has sparked both intrigue and confusion in recent months, particularly as Anthropic's fraught relationship with the Trump administration caused complications.
In June, Anthropic said it had to disable access to Mythos 5, an updated version of the model, and Fable 5, a version of Mythos that it released more broadly, in order to comply with an export control directive from the federal government that cited "national security authorities."
Commerce Secretary Howard Lutnick granted the company permission to restore access to Mythos to a select group of "trusted partners," according to a letter viewed by CNBC. The export controls were later lifted entirely.
The Trump administration has been taking a much more active role in AI regulation since President Donald Trump signed an AI executive order in June. But questions remain about who is calling the shots on AI policy behind the scenes, and the scrambling at the Fed — which Trump chose Warsh to lead — is another sign of chaos.
Chris Fall, head of the Center for AI Standards and Innovation, resigned from his role as director just three months after he was picked for the job by the Trump administration, CNBC confirmed on Monday. Venture capitalist David Sacks previously held the position of White House AI and crypto czar, but he stepped down from that role in March.
Pressure is building.
Chinese open-weight models are gaining steam against leading offerings from U.S. companies like OpenAI and Anthropic, sparking concerns from tech executives and government officials about the durability of the U.S. lead in the AI race. Moonshot AI, a Chinese startup, released a model called Kimi K3 earlier this month that outperforms those companies across some industry benchmarks.
Sacks said in a post on X on Friday that Kimi K3's performance is "concerning," and that "America is tying itself in knots."
"This is how you lose the AI race," he wrote. "The rest of the world won't play by our rules if we bog ourselves down."
Futurum's Newman said the Fed is "certainly is going to play catch up" since it hasn't had access to the cutting-edge models that other agencies have.
"Every day, every week, whether it's China's innovation or U.S. innovation, technology leaders inside of large institutions are facing a constant barrage of net innovation," he said.
Four leading AI models discuss this article
"This story highlights inter-agency AI-access friction and signaling more than an imminent cybersecurity failure at the Federal Reserve."
The article portrays bureaucratic chaos and Trump-era AI policy friction leaving the Fed exposed to emerging cyber risks from advanced models like Anthropic's Claude Mythos. Yet the strongest counter-case is that this is largely theater: the Fed already collaborates with CISA, has internal red-team capabilities, and benefits from banks (JPM, others) patching first. The three-month lag sounds alarming but likely reflects controlled rollout, export-compliance checks, and selective access rather than systemic vulnerability. Missing context includes that Mythos is a preview tool for vulnerability discovery, not an autonomous exploit, and Fed access to similar models from OpenAI/Google has been routine. Warsh's testimony reads as positioning for more inter-agency authority, not panic.
If the Fed truly lacked cutting-edge offensive cyber-AI while banks and tech peers patched ahead, it risks asymmetric information that could amplify a real breach into systemic instability; the export-control flip-flops and rapid leadership churn at CAISI and White House AI roles suggest genuine policy incoherence that foreign adversaries (China's Kimi K3) could exploit faster than the article implies.
"The widening gap between private-sector AI defensive capabilities and the Fed's oversight capacity introduces a significant, unpriced systemic risk to the financial system."
The Fed’s lack of access to Anthropic’s Mythos model isn't just bureaucratic incompetence; it highlights a dangerous bifurcation in systemic risk management. While Tier-1 banks like JPMorgan Chase (JPM) are using Project Glasswing to harden their infrastructure, the central bank is operating with a 'blind spot' regarding the very tools that could facilitate a catastrophic cyber-event. This creates a regulatory lag that undermines the Fed’s ability to conduct stress tests effectively. If the regulator is three months behind the private sector in understanding offensive AI capabilities, systemic stability is far more fragile than the current market pricing suggests. We are effectively witnessing a 'cyber-arms race' where the private sector is outpacing the oversight mechanism designed to contain it.
The Fed may be intentionally avoiding direct access to avoid liability for model-generated code, preferring to set standards rather than participate in the development loop.
"The real risk isn't Mythos itself but that fragmented, understaffed AI governance means U.S. financial institutions are patching vulnerabilities on uneven timelines while policy leadership remains unclear."
This article conflates three separate failures—bureaucratic access delays, export control chaos, and policy confusion—into a narrative of systemic vulnerability. The Fed's three-month lag accessing Mythos is genuinely concerning for financial sector cybersecurity resilience. However, the article overstates the threat by implying the Fed was uniquely exposed; most banks also lacked access initially. The real story is institutional fragmentation: Commerce Department export controls, unclear AI governance hierarchy, and rapid staff turnover (Fall, Sacks departures) suggest policy is reactive, not strategic. The Chinese AI competitive angle feels grafted on—Kimi K3 benchmarks don't address whether U.S. financial institutions are actually more vulnerable than before Mythos existed.
The Fed's delay may reflect appropriate caution rather than negligence—rushing access to a novel vulnerability-detection tool without proper vetting could introduce new risks. Additionally, Anthropic's phased rollout suggests deliberate prioritization of financial institutions first, meaning the Fed's lag was weeks, not months of true exposure.
"The Fed-access saga signals more about governance and multi-model risk management than an impending AI-caused financial crisis."
The piece portrays Mythos as a linchpin in banking cybersecurity and cites the Fed’s access lag as a systemic risk. The strongest takeaway for markets is risk sentiment tilt and potential acceleration of AI governance and treasury-bank coordination, not an immediate capital need. Yet there are big holes: we don’t know Mythos’s real-world effectiveness, whether access translates into actionable patches, or if the banks already have parallel tools. The Fed’s access frictions could reflect bureaucratic/policy signals rather than a technical failure. Moreover, China’s Kimi K3 and other models could compress the strategic window, nudging banks toward diversified AI risk management rather than a single vendor dependency.
If Mythos can reliably surface zero-days and patches, the Fed’s access delay would be a real vulnerability; but absence of access may simply reflect policy, not exposure. Moreover, patching is only as good as developers' implementation and governance, so the risk may be overstated.
"The Fed's intentional lag on offensive AI tools may incentivize banks to hide vulnerabilities, amplifying systemic risk beyond access delays."
Gemini's bifurcation claim ignores that the Fed's role is supervisory, not operational. Banks like JPM using Glasswing create private-sector alpha the regulator deliberately lags to avoid capture. The real unmentioned risk is regulatory arbitrage: if Mythos surfaces bank-specific zero-days, supervised institutions may withhold findings to protect competitive edges, widening the exact asymmetry Gemini fears.
"Banks have a perverse incentive to withhold AI-discovered vulnerability data from the Fed to avoid regulatory overreach, exacerbating systemic risk."
Grok, your point on regulatory arbitrage is the missing link. If JPM or GS discover a zero-day via Mythos, they have a fiduciary duty to shareholders to patch, but a regulatory incentive to delay disclosure to the Fed to avoid 'heightened scrutiny' or forced remediation. This creates a dangerous information asymmetry. The Fed isn't just lagging in access; they are being actively managed by the institutions they oversee, turning 'supervision' into a reactive game of catch-up.
"Regulatory arbitrage via withholding is legally constrained; the real question is whether the Fed's supervisory role requires offensive AI tools or just better reporting standards from banks."
Gemini and Grok's regulatory arbitrage concern is real, but assumes banks will withhold zero-day findings to the Fed. That's backwards: disclosure to regulators is legally mandated under SR 11-7 (cybersecurity guidance). The actual risk is slower *remediation*—banks patch themselves first, report later. The Fed's lag matters only if it prevents supervisory stress-testing of systemic resilience, not if it merely delays notification. Has anyone confirmed the Fed actually needs Mythos access to conduct cyber stress tests, or is this a capability-gap assumption?
"The root risk is governance and data-flow gaps to the Fed for stress testing, not Mythos access lag alone."
Gemini's regulatory-arbitrage framing elevates the information-asymmetry risk, but the bigger flaw is assuming banks will voluntarily disclose zero-days quickly. The real systemic risk may come from fragmented governance and incomplete data flows into the Fed for stress testing; even patched systems can leave residual risk if banks don’t publish consistent telemetry, audit trails, or standardized incident data. Mythos access lag thus becomes a symptom, not the root cause.
The panel consensus is that the Fed's lag in accessing Anthropic's Mythos model poses a significant risk to financial sector cybersecurity resilience, with potential information asymmetry and regulatory arbitrage concerns. However, the exact nature and severity of the risk remain debated.
Accelerated AI governance and treasury-bank coordination to address the identified risks.
Regulatory lag and potential information asymmetry due to banks withholding zero-day findings from the Fed.