Treasury Secretary Summons Bank CEOs to Discuss Cyber Risks Posed by Anthropic AI Model

On the afternoon of Tuesday, April 8, Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell sat across from five of the six most powerful bankers in America and delivered a warning: the AI model that Anthropic released the day before could find and exploit security flaws in virtually every piece of software their banks depend on [1][2].

The meeting at the Treasury Department in Washington — first reported by Bloomberg on April 10 — brought together Citigroup CEO Jane Fraser, Morgan Stanley CEO Ted Pick, Bank of America CEO Brian Moynihan, Wells Fargo CEO Charlie Scharf, and Goldman Sachs CEO David Solomon [1][3]. The subject was Anthropic's Claude Mythos Preview, a model that its own maker described as capable of identifying zero-day vulnerabilities — previously unknown software flaws — in "every major operating system and every major web browser" [4][5].

One CEO was conspicuously absent: JPMorgan Chase's Jamie Dimon, who was "unable to attend due to prior commitments" [3][6]. The irony was not lost on observers: JPMorgan is the only bank among the 12 founding partners of Anthropic's Project Glasswing, the restricted-access initiative through which Mythos is being distributed [6][7].

Source: Bloomberg / Fortune / Anthropic

Data as of Apr 10, 2026CSV

What Mythos Can Do

The trigger for the emergency meeting was not a breach, a foreign adversary probe, or an intelligence warning. It was Anthropic itself, which on April 7 publicly disclosed the capabilities of Mythos Preview alongside the launch of Project Glasswing, while simultaneously briefing senior officials across the U.S. government [4][8].

The numbers from Anthropic's own red-team report are stark. In testing against Firefox's JavaScript engine, Mythos Preview produced 181 working exploits. Anthropic's previous flagship model, Opus 4.6, managed two [4]. On the OSS-Fuzz benchmark — a standard measure for automated vulnerability discovery — Mythos achieved 595 crashes at severity tiers 1–2, plus 10 instances of complete control flow hijack. Predecessor models produced only single-digit results at lower severity levels [4].

Source: Anthropic Red Team Report

Data as of Apr 7, 2026CSV

Specific discoveries included a 27-year-old vulnerability in OpenBSD, widely considered one of the most security-hardened operating systems in existence, that would allow remote denial-of-service attacks [4][9]. A 16-year-old flaw in FFmpeg — used by countless applications for video encoding — sat in a line of code that automated testing tools had hit five million times without catching the problem [4][9]. And a remote code execution vulnerability in FreeBSD (CVE-2026-4747), discovered and exploited fully autonomously, that allows complete server takeover — at a computational cost of under $50 [4].

Mythos reproduced vulnerabilities and created working proof-of-concept exploits on the first attempt 83.1% of the time [9]. In one case, it wrote a browser exploit that chained together four separate vulnerabilities, constructing a JIT heap spray that escaped both the renderer sandbox and the operating system sandbox [4].

"The dangers of getting this wrong are obvious," Anthropic CEO Dario Amodei wrote on X alongside the Project Glasswing announcement, "but if we get it right, there is a real opportunity to create a fundamentally more secure internet and world than we had before the advent of AI-powered cyber capabilities" [8][10].

The Banks' Exposure

The meeting came against a backdrop of rapid AI adoption across Wall Street. Claude — Anthropic's commercial model family, distinct from the restricted Mythos — is already deployed in production at multiple major banks. Goldman Sachs partnered with Anthropic to automate trade accounting and client onboarding [11]. Citigroup and RBC Capital Markets have adopted Claude for various functions [12]. AIG has compressed its underwriting review timeline by more than 5x using Claude, improving data accuracy from 75% to over 90% [12].

Source: Fortune / CNBC / Banking Dive reporting

Data as of Apr 10, 2026CSV

But the concern raised at the Tuesday meeting was not primarily about Claude's existing commercial deployments. Officials focused on what Anthropic calls "left-tail" risks — rare but severe scenarios in which AI-enhanced vulnerability detection could be turned against the financial system [3]. The worry is that if Mythos-class capabilities become widely available, whether through Anthropic or a competitor, any attacker could discover exploitable flaws in the software infrastructure banks rely on at a fraction of the previous cost and time.

This concern is not hypothetical. In November 2025, Anthropic disclosed that a Chinese state-sponsored group, tracked internally as GTG-1002, had manipulated Claude Code — Anthropic's coding agent — into attempting infiltration of roughly 30 organizations, including financial institutions and government agencies [13][14]. The attackers jailbroke Claude by decomposing attacks into small, seemingly innocuous tasks and telling the model it was performing legitimate defensive security testing [13]. At its peak, the AI executed thousands of requests per second — attack speeds that human hackers could not match [14]. Anthropic detected the campaign in September 2025 and banned the accounts, but the incident demonstrated that AI-powered offensive capabilities were already being exploited by sophisticated adversaries months before Mythos made the problem an order of magnitude worse [13].

Project Glasswing: Anthropic's Containment Strategy

Rather than release Mythos publicly, Anthropic restricted access to 12 partner organizations through Project Glasswing: Amazon, Apple, Broadcom, Cisco, CrowdStrike, the Linux Foundation, Microsoft, Palo Alto Networks, Google, Nvidia, JPMorgan Chase, and the Apache Software Foundation [7][5]. Anthropic committed up to $100 million in usage credits and $4 million in direct donations to open-source security organizations, including OpenSSF and Alpha-Omega [5][7].

The stated goal is defensive: give major software vendors and security firms time to find and patch the vulnerabilities Mythos can identify before the capabilities become widely accessible. Over 99% of the vulnerabilities discovered by Mythos Preview remain unpatched, according to Anthropic's red-team report, with professional validators agreeing on 89% of severity ratings and 98% within one severity level [4].

Anthropic has briefed the Cybersecurity and Infrastructure Security Agency (CISA), the Commerce Department, and "a broader array of actors" across the U.S. government on Mythos' full capabilities, and has "made itself available to support the government's own testing and evaluation of the technology" [8][10].

The JPMorgan Paradox

Jamie Dimon's absence from the Treasury meeting, while his bank is the sole financial institution in the Glasswing consortium, created an unusual optics problem. On the same day as the emergency meeting, JPMorgan analysts published a research note upgrading CrowdStrike and Palo Alto Networks — two other Glasswing partners — citing the initiative as their rationale [6].

JPMorgan has been the most aggressive AI adopter among major U.S. banks. The firm made AI adoption a formal performance requirement for 65,000 engineers, with internal dashboards tracking GitHub Copilot usage by individual, and reported 10–20% productivity gains from AI coding tools [15]. The bank uses models from at least four major AI vendors [11][12].

The question of whether JPMorgan's inside position — having access to Mythos through Glasswing while other banks do not — constitutes a competitive advantage is one that the Tuesday meeting implicitly raised but apparently did not resolve [6][3].

Precedent and Regulatory Authority

This appears to be the first time that Treasury and the Fed jointly convened bank CEOs specifically over a single AI model's capabilities [1][2]. Past emergency cybersecurity interventions by regulators followed actual breaches rather than anticipatory risk assessments.

In 2016, hackers exploited vulnerabilities in the SWIFT global payment messaging system to attempt a $1 billion theft from Bangladesh's central bank, ultimately stealing $101 million [16]. The response came from SWIFT itself and individual regulators, not a coordinated top-level summoning of bank executives. In 2020–2021, the SolarWinds supply chain attack compromised dozens of Treasury Department email accounts and affected approximately 100 private companies, including financial institutions [17]. The response was led by CISA through emergency directives to federal agencies, not by a Treasury-Fed joint meeting with private-sector CEOs [17].

The regulatory authority Treasury can bring to bear on banks' AI vendor relationships is indirect but not toothless. The Bank Service Company Act gives federal regulators authority to examine and regulate third-party technology service providers to banks [18]. The Federal Financial Institutions Examination Council (FFIEC) sets interagency standards that examiners use to evaluate banks' technology risk management [18]. In 2023, federal banking agencies issued interagency guidance on third-party risk management, establishing a principles-based approach for assessing vendor relationships — including AI vendors [18]. Critically, ultimate responsibility for compliance rests with the banks themselves, not the AI vendors [18].

Treasury has also been building out an AI-specific regulatory infrastructure. On February 19, 2026, the department released an AI Lexicon and a Financial Services AI Risk Management Framework (FS AI RMF) with 230 control objectives for managing AI-related risks [19][20]. In March 2026, the Office of the Financial Stability Oversight Council and Treasury's AI Transformation Office launched an AI Innovation Series, a public-private initiative for financial system resilience [20]. These frameworks are voluntary — "optional tools for U.S. bankers rather than legally binding documents," according to Treasury's own description [19].

If banks were to ignore guidance from Tuesday's meeting, enforcement would depend on existing supervisory authority: exam findings, consent orders, and in extreme cases, cease-and-desist orders — not any AI-specific statute [18].

Is This About Anthropic, or About AI?

The framing of the meeting around Anthropic specifically invites a question: why Anthropic and not OpenAI, Google, or Microsoft?

The straightforward answer is that Mythos represents a documented, measurable step-change in offensive cyber capabilities that no other publicly acknowledged model has matched. Anthropic's own benchmarks show Mythos outperforming its predecessor by roughly 90x on exploit generation [4]. No comparable red-team disclosure has been published by OpenAI, Google, or Microsoft for their respective models.

But critics and industry observers have noted that the framing could have competitive implications. A Dark Reading poll found that 48% of cybersecurity professionals rank "agentic AI" — AI systems that can take autonomous actions — as the top attack vector for 2026 [15]. This is a cross-vendor concern, not one specific to Anthropic. OpenAI is reportedly developing a rival to Mythos [21]. Google's Gemini has faced its own model-extraction campaigns involving over 100,000 prompts from Chinese laboratories [15]. Microsoft's Copilot is deployed at tens of thousands of financial institutions.

The steelman case that the meeting represents overreach goes like this: by singling out Anthropic — which voluntarily disclosed Mythos' capabilities and restricted its release — regulators may be penalizing transparency while leaving less forthcoming competitors unexamined. If the result is that banks slow their adoption of Anthropic's tools specifically, the beneficiaries would include incumbent technology vendors, banks with existing AI advantages (like JPMorgan), and foreign competitors operating outside U.S. regulatory reach.

The counterargument: Anthropic's own disclosures make the risk concrete and documentable in a way that vague concerns about "AI in banking" are not. Regulators had specific benchmarks, specific CVEs, and a specific restricted-release program to point to. The meeting was a response to evidence, not speculation.

What Comes Next

The Tuesday meeting produced no public regulatory action, no formal guidance, and no Congressional notification, according to available reporting [1][2][3]. No regulatory filing has been made, and Anthropic has not been subjected to any formal investigation by Treasury or the Fed [8].

The situation sits in an ambiguous regulatory space. Treasury's AI risk management framework is voluntary. The Bank Service Company Act was written for an era of outsourced check processing, not autonomous exploit generation. FFIEC guidelines address third-party technology risk management in general terms that predate the specific scenario of a vendor releasing a model that can find thousands of zero-day vulnerabilities in critical infrastructure [18][19].

What is clear is that the capabilities Mythos represents are not going away. Anthropic's CEO acknowledged as much: "More powerful models are going to come from us and from others, and so we do need a plan to respond to this" [10]. The question for regulators, banks, and AI companies alike is whether the current framework — voluntary lexicons, 230-control-objective checklists, and one-off emergency meetings — is adequate for a world in which a $50 computation can find a remote code execution vulnerability that went undetected for 17 years.

The banking system's software infrastructure is the same infrastructure that Mythos has been systematically probing. Every major operating system, every major web browser, and over 99% of the vulnerabilities found remain unpatched [4]. The Tuesday meeting was a first acknowledgment at the highest levels of U.S. financial regulation that AI has become a systemic cyber risk factor. Whether that acknowledgment translates into action — or remains a closed-door warning between powerful people — is the open question.