Anthropic's Mythos AI Is Finding Thousands of Security Holes in US Bank Systems — and Banks Are Scrambling

AI Just Exposed Decades of Banking Negligence

America's largest banks are in full damage-control mode. According to Reuters, Anthropic's powerful Mythos AI tool — already flagged by regulators and policymakers as a serious threat to the financial sector — is uncovering hundreds to thousands of IT vulnerabilities inside the systems that hold your money.

These institutions manage trillions of dollars. They employ armies of compliance officers and IT staff. They spend billions on cybersecurity annually. A single AI tool is exposing more holes than their entire internal security apparatus apparently caught.

What Mythos Actually Does

Mythos isn't just scanning for obvious flaws. According to multiple sources cited by Reuters, the tool is expert at chaining together low-risk vulnerabilities into high-risk attack pathways.

A bank might have known about a dozen minor vulnerabilities and classified them as low priority. Mythos strings them together and shows a pathway into the vault.

Nitin Seth, co-founder and CEO of AI services firm Incedo, said: "This is a wake-up call because cyber risk is moving to machine speed, while much of bank defense still operates at human speed."

It took an outside AI company to make that obvious.

The Dirty Secret: Aging Tech Nobody Wanted to Fix

Mythos is particularly lethal at finding flaws in proprietary and open-source code that is at the end of its software support lifecycle, according to a source at one of the major banks cited by Reuters.

Banks have been running software that the developers themselves no longer update or patch. Officially unsupported. Dead in the water from a security standpoint. Nobody forced them to upgrade because the vulnerabilities were hidden well enough that nobody was demanding action.

This isn't a technical failure. It's a management failure. Banks made the calculated bet that legacy systems were good enough, that security-through-obscurity would hold, and that patching ancient code was too expensive and disruptive to bother with. Mythos exposed that bet.

The Pace Is the Problem

According to Reuters, banks are now patching vulnerabilities in days that they previously would have waited weeks to address. The increased workload is likely to result in banks having to take systems offline more frequently, according to sources familiar with the matter cited in both Reuters and The Star. That means real disruption. Failed transactions. Delayed transfers. Frozen access. For regular customers.

Your bank may lose access to your money temporarily because it spent years ignoring infrastructure debt.

Only the Big Banks Have Mythos — For Now

Only a handful of the country's largest lenders currently have access to Mythos, according to Reuters. It's powerful and costly.

The larger banks are sharing some findings with smaller institutions so they can prepare. But those smaller banks — community banks, regional lenders, credit unions — don't have the resources for emergency patching campaigns at machine speed. They're getting a warning with no real tool to act on it fast.

If Mythos-style attack capabilities end up in the hands of hostile actors — and they will, eventually — the smaller banks are the soft targets. Your local credit union doesn't have a war room.

What Mainstream Coverage Is Missing

Nearly every outlet running this story is framing it as a technology challenge. It's an accountability story.

Who signed off on running end-of-life software across critical financial systems? Who approved IT budgets that kept legacy code limping along? Which executives collected bonuses while deferring infrastructure upgrades that regulators now say pose systemic risks?

Not one source report names a single bank by name or holds a single executive accountable. The sources are all anonymous. The banks are unnamed. The vulnerabilities are vague. The coverage reads more like a press release with anonymous quotes than reporting.

Regulators and policymakers have issued "a series of warnings" about Mythos, according to Reuters. Which regulators? What warnings? When? The coverage doesn't say.

What This Means for You

If you bank at one of America's large institutions, your accounts are likely being protected by systems that an AI can shred in minutes. The banks know this now. They're fixing it — fast, messy, and under pressure. That rush increases the chance of something breaking during the patch.

Expect intermittent outages. Expect service disruptions. Expect zero warning from your bank when they happen.

The larger question is why it took a private AI company to force this reckoning. Federal banking regulators have had access to these banks' IT systems for decades. Where were they?

Banks don't fix what they're not forced to fix. Mythos just became the forcing function. That's positive for long-term security. The short-term pain is coming, and your bank isn't going to tell you about it until it's already happening.