Anthropic's Claude Mythos Model: Cybersecurity Threat Levels, AISI Evaluations, and Global Banking Sector Response

Anthropic's unreleased model, Claude Mythos, has sent shockwaves through the financial services sector due to its unprecedented offensive and defensive cybersecurity capabilities. While Anthropic has declined to release the model publicly to prevent exploitation by malicious hackers, it has granted restricted access to a select group of major banks and technology companies to help audit critical systems.

AISI Evaluations: A Dramatic Leap in Cyber Capabilities

The UK’s AI Security Institute (AISI) has tracked the evolution of the model's capabilities, revealing a dramatic leap in performance between April and May 2026:

• The "Preview" Model (April 2026): In its initial evaluation of Claude Mythos Preview (announced April 7, 2026), the AISI reported that the model succeeded in expert-level Capture the Flag (CTF) challenges 73% of the time (expert-level tasks were unsolvable by any model prior to April 2025). It also became the first model to solve "The Last Ones" (TLO)—a highly complex 32-step corporate network attack simulation requiring reconnaissance and full network takeover—completing it from start to finish in 3 out of 10 attempts. However, it was unable to solve the operational technology (OT) "Cooling Tower" range.
• The Latest Iteration (May 2026): Scrutinizing the version of Mythos released to banks and tech companies, the AISI issued an updated appraisal in mid-May 2026 detailing a "notable capability jump" over the preview version. The latest iteration of Mythos successfully completed the previously unsolved "Cooling Tower" cybersecurity test in 3 out of 10 attempts, marking a first for any AI model.

The AISI warned that the autonomous cyber capabilities of frontier models are advancing quickly, with the length of tasks they can complete autonomously doubling on the order of months.

Global Banking Sector and Regulatory Mobilization

The sudden escalation in AI-enabled cyber capabilities has prompted urgent actions from financial institutions and central regulators:

• Restricted Bank Access: Anthropic has provided restricted access to Mythos to a select group of banks—including JPMorgan Chase and Apple—to help them preemptively locate and patch critical IT vulnerabilities.
• Bank Executive Responses: Goldman Sachs CEO David Solomon stated he is "hyper-aware" of the risks posed by Mythos. JPMorgan Chase CEO Jamie Dimon noted that while agentic AI makes cyber defense "harder" in the short term, it will ultimately help banks defend their networks.
• The Financial Stability Board (FSB) Briefing: Anthropic is scheduled to brief the global finance watchdog—the FSB (chaired by Bank of England Governor Andrew Bailey)—on the implications of Claude Mythos and emerging frontier risks to global financial stability.
• IMF and FCA Directives: On May 7, 2026, the International Monetary Fund (IMF) warned that financial stability risks are rising due to "fast-moving" AI-fueled cyberattacks, calling for a globally coordinated oversight response. Meanwhile, UK Financial Conduct Authority (FCA) chief Nikhil Rathi directed financial firms to "double down" on core cyber hygiene, focusing on legacy systems, robust detection mechanisms, and recovery governance.