Anthropic's AI Can Break Your Bank
What happened
Anthropic's Claude Mythos, unveiled in early April 2026, has demonstrated the ability to autonomously discover and exploit thousands of zero-day vulnerabilities across complex software systems. Treasury Secretary Scott Bessent and Federal Reserve Chair Jerome Powell called an emergency meeting with the CEOs of the five largest US banks to assess exposure. The Pentagon, separately, is reportedly considering designating Anthropic a 'supply chain risk,' which would bar it from government contracts and force DoD contractors to cut ties with the company. Wall Street banks are now running internal red-team tests using Mythos, at Washington's urging, to find their own vulnerabilities before adversaries do.
The US government is simultaneously treating Anthropic as a national security threat and relying on its tool to defend national security infrastructure: that contradiction cannot hold.
The Hidden Bet
Running Mythos against your own systems to find vulnerabilities is a net security gain
Any institution that runs Mythos produces a detailed map of its own vulnerabilities. That map, once created, is itself a high-value target. The act of testing may create a new attack surface.
The Pentagon's supply chain risk designation is about security, not competitive positioning
Designating Anthropic a supply chain risk would channel DoD AI contracts exclusively to competitors. The designation is a procurement weapon disguised as a safety measure.
This is primarily a cybersecurity story
The deeper question is who controls a system capable of breaking any software at scale. The cybersecurity framing obscures that this is a power-concentration story.
The Real Disagreement
The fork is between two responses to a model that can autonomously break systems. The first says: restrict access, treat it like a weapon, let government control deployment. The second says: push it out fast, use it defensively, and accept that adversaries will build the same capability regardless. The first approach buys time but creates a monopoly in whoever controls access. The second accepts that a defensive advantage today requires wide availability that enemies will also use. Neither path avoids the damage; they just allocate it differently. The defensive-access argument has the better near-term case, but it assumes attackers are not already there, and that assumption is probably wrong.
What No One Is Saying
Anthropic disclosed this capability. That disclosure is its own strategy: by making the threat visible, Anthropic made itself indispensable to the government it is simultaneously being threatened by. Announcing that your product can break everything is the fastest way to ensure no one can afford to exclude you.
Who Pays
Community banks and credit unions
Within 12 months, as Mythos-derived exploit techniques diffuse
They lack the resources to run Mythos-style red-teams on their own infrastructure. Larger banks testing and patching their systems creates a security gap between institutions that will widen fast.
Federal contractors not affiliated with Anthropic or its rivals
Immediately if the designation is finalized
If the Pentagon supply chain risk designation proceeds, any contractor using Anthropic tools must either switch vendors at cost or lose government business
Depositors at institutions with legacy core banking systems
The vulnerability exists now; exploitation risk rises as Mythos or equivalents spread
Older core banking platforms built in COBOL have the largest zero-day exposure. Mythos-style attacks targeting those systems could freeze accounts or corrupt transaction records.
Scenarios
Controlled access carve-out
The Pentagon backs off the supply chain designation, Anthropic gets a restricted government-licensed deployment path for Mythos, and Wall Street banks receive mandatory audit requirements using the tool.
Signal Treasury and DoD issue a joint framework for 'dual-use AI security tools' within the next 60 days
Designation proceeds, splits market
Pentagon designates Anthropic a supply chain risk. Government contracts flow to OpenAI and Google. Anthropic pivots to commercial and allied-nation deployment of Mythos, creating a parallel security apparatus outside US government oversight.
Signal Anthropic announces a major European or UK government partnership within 90 days
Adversary deployment first
A state actor releases a Mythos-equivalent publicly before the US government resolves its Anthropic question. The defensive window closes, and the debate becomes moot.
Signal CISA issues an emergency alert about AI-assisted zero-day campaigns attributed to a foreign nation-state
What Would Change This
If Anthropic shared Mythos capabilities with the Pentagon under an existing contract and the supply chain risk designation is withdrawn, the story becomes evidence of a functioning public-private security relationship rather than a breakdown. The contradiction resolves only if the government picks a side.