U.S. Banks Race to Repair IT Weaknesses Exposed by Powerful Mythos AI Cybersecurity Tool

BY COMOFORT OGBONNA

Major U.S. banks are scrambling to repair hundreds and in some cases thousands of technology vulnerabilities uncovered by Anthropic’s advanced Mythos artificial intelligence system, triggering urgent software upgrades, accelerated security reviews, and concerns about possible disruptions to banking services.

Several of America’s largest financial institutions have gained access to the powerful AI model, known as Claude Mythos Preview, and are now uncovering weaknesses in their systems at a pace far beyond traditional cybersecurity methods. According to people familiar with the matter, the findings have prompted banks to rapidly strengthen aging infrastructure and patch vulnerabilities that might previously have taken weeks or even months to address.

The banking industry has long relied on complex legacy systems, many of which were not designed for the speed and sophistication of modern AI-driven cyber threats. Security experts say Mythos is changing the landscape by identifying hidden weaknesses with extraordinary speed and precision, exposing risks that human teams may have struggled to detect on their own.

“This is a wake-up call because cyber risk is moving to machine speed, while much of bank defense still operates at human speed,” said Nitin Seth, co-founder and chief executive of Incedo, a company focused on digital, data, and AI services. He warned that the technology challenges a long-standing assumption within the banking sector — that vulnerabilities can remain undiscovered for extended periods before attackers exploit them.

Cybersecurity specialists say Mythos is particularly effective at linking multiple lower-level weaknesses together to create high-risk attack paths. While many of the individual flaws may appear minor on their own, the AI system can identify how they interact across large and highly interconnected banking networks.

This capability is forcing banks to move much faster than usual. Institutions are now rushing to confirm software is fully updated and supported, especially systems running on older technology that may no longer receive regular security maintenance. Sources familiar with the process said some vulnerabilities are now being patched within days rather than weeks, reflecting the pressure banks face to respond quickly.

The workload created by these rapid security fixes could also increase the chances of temporary service interruptions. Industry sources said some systems may need to be taken offline more frequently so upgrades and repairs can be implemented safely. However, banks are attempting to manage the process in ways that minimize disruption for customers and financial markets.

Experts say the emergence of AI-powered cybersecurity tools is fundamentally changing the way banks operate. Rather than conducting occasional security reviews, institutions may soon need to monitor and patch vulnerabilities continuously in near real time.

One major challenge for smaller banks is the cost and computing power required to use advanced AI systems like Mythos. The model is expensive to run and demands significant processing infrastructure, making it more accessible to the largest global banks than to regional or community lenders.

Despite that limitation, larger institutions are reportedly sharing some of their findings and security insights with smaller banks to help them prepare their own systems against emerging threats.

Anthropic’s pricing model reflects the heavy computational demands of the technology. Claude Mythos Preview charges users based on the number of “tokens,” or units of data, processed by the system. According to the company, it costs $25 per million input tokens and $125 per million output tokens, making it substantially more expensive than Anthropic’s more widely available AI model, Opus 4.7.

To encourage adoption and cybersecurity research, Anthropic has said it will provide up to $100 million in usage credits to partners involved in its Project Glasswing initiative and other approved Mythos users. The company has also issued broader recommendations for organizations seeking to improve cyber defenses, even if they do not yet have access to Mythos directly.

Anthropic executive Mike Krieger recently said the company aims to balance safety, accessibility, and business sustainability when setting prices for advanced AI systems. He explained that pricing must remain affordable enough to encourage widespread use while still supporting the significant costs of developing and operating the technology.

Access to Mythos was initially limited to selected organizations participating in Anthropic’s Project Glasswing program. Among the major financial institutions believed to have access are JPMorgan Chase & Co., Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley.

Cybersecurity company CrowdStrike, which also participates in Project Glasswing, has described the system as transformative but difficult to master initially. Adam Meyers, who leads counter-adversary operations at CrowdStrike, said his team spent an entire weekend developing methods to fully understand how to use the model effectively before beginning large-scale vulnerability testing.

Regulators are also closely monitoring the rapid rise of AI-powered cyber tools. A senior banking regulatory official said Mythos has proven to be as powerful as many experts feared, particularly because of its ability to quickly connect seemingly unrelated weaknesses across large technology systems.

Security analysts warn that while all industries face growing cyber risks, banks remain uniquely vulnerable because technology systems sit at the very center of their operations. Bernard Montel of Tenable noted that disruptions within banking infrastructure can directly affect payments, trading systems, customer accounts, and broader financial stability.

As artificial intelligence continues to reshape cybersecurity, many experts believe the financial industry is entering a new era in which defending digital infrastructure will require constant adaptation, faster decision-making, and significantly higher levels of investment in technology and security operations.