Mythos Goes Global: Japan's Megabanks Get Access in Two Weeks, Congress Demands a Closed-Door Briefing, and Experts Say the Panic Is Missing the Point

Mythos Goes Global: Japan's Megabanks Get Access in Two Weeks, Congress Demands a Closed-Door Briefing, and Experts Say the Panic Is Missing the Point

Three significant developments have emerged since earlier coverage of Anthropic's Mythos AI system.

First, according to Reuters, Japan's megabanks are set to gain access to Mythos within approximately two weeks. This marks the first major international expansion of the controlled rollout, which until now has been limited to a handful of U.S. firms including Apple, Amazon, JPMorgan Chase, and Palo Alto Networks.

Second, The Hill reports that the House Committee on Homeland Security has called Anthropic in for a closed-door briefing on Mythos — specifically over safety risks and what Washington is calling the potential for AI-enabled catastrophic cyber events.

Third, experts are now publicly challenging the narrative around Mythos, arguing the panic is misdirected.

The Expert Verdict: The Threat Was Already Here

CNBC spoke to cybersecurity researchers who offered a different perspective on the Mythos concerns.

Ben Harris, CEO of cybersecurity firm watchTowr, told CNBC: "What we are seeing across the industry now is that people are able to reproduce the vulnerabilities found with Mythos through clever orchestration of public models to get very, very similar results."

In other words, the vulnerabilities Mythos finds are not unique to it.

Anthropic didn't dispute this when CNBC asked. Older models — including Anthropic's Claude and OpenAI's GPT line — are capable of hunting software vulnerabilities. Mythos is faster and more systematic. But it isn't performing a fundamentally new capability.

The Real Problem Mythos Exposed

According to Reuters and the Economic Times, U.S. banks testing Mythos are finding hundreds to thousands of low-to-moderate severity vulnerabilities — and discovering that Mythos excels at chaining those smaller weaknesses together into a single high-risk exploit.

Nitin Seth, CEO of AI services firm Incedo, told Reuters: "This is a wake-up call because cyber risk is moving to machine speed, while much of bank defense still operates at human speed."

Banks are being forced to patch in days what they previously assumed they had months or years to fix. Some of these vulnerabilities have been sitting in legacy code untouched for years. Mythos identified them in hours.

Larger banks with direct Mythos access are now passing vulnerability data down to smaller banks that don't have the tool. This coordination has strengthened the industry response.

Congress Wants Answers

The House Homeland Security Committee isn't waiting for the private sector to sort this out. The closed-door briefing with Anthropic signals that Washington is taking this seriously at the oversight level.

The Trump administration is also reportedly considering new government oversight requirements for future models of this power class, according to CNBC. Whether that results in smart, targeted regulation or bureaucratic overreach remains to be seen.

But the impulse to understand what Mythos is doing before it goes further is appropriate.

OpenAI Didn't Miss the Moment

Weeks after Mythos dropped, OpenAI CEO Sam Altman announced GPT-5.5-Cyber — a model purpose-built for cybersecurity. According to CNBC, OpenAI began allowing limited access to vetted cybersecurity teams on Thursday.

Anthropic finds a market. OpenAI responds. Both companies are now racing toward IPOs, with cybersecurity as a key battleground.

The controlled rollout of Mythos — which Anthropic calls Project Glasswing — was designed to give corporations a head start patching before bad actors acquired equivalent capability. The logic is sound, though criminal groups and nation-state hackers have had access to adjacent tools for some time.

What Mainstream Coverage Is Getting Wrong

Most coverage has treated Mythos as a singular, unprecedented threat — a line in the sand between the old cyber era and a new one.

AI-assisted vulnerability discovery has been accelerating for years. Mythos didn't create the threat. It industrialized it and made it impossible to ignore. Banks, regulators, and executives now expressing concern should have been monitoring AI-assisted hacking tools two years ago.

CNBC deserves credit for reporting the expert consensus rather than amplifying worst-case narratives. Most outlets buried the "this was already possible" angle or skipped it entirely.

What It Means for Regular People

If you bank with any major U.S. institution, your bank is actively patching systems right now. Some of those patches may cause service disruptions — the Economic Times flagged this risk.

Your money is not disappearing. But the systems that protect it are being stress-tested at a pace the industry has never experienced.

Japan's megabanks gaining access in two weeks makes this a global infrastructure story. With Congress now involved, the days of Anthropic controlling the narrative around Mythos are numbered.

The vulnerability was never just in the banks' code. It was in the assumption that threats move at human speed. They don't.