The Fed Still Doesn't Have Access to Anthropic's Mythos AI Model, Chairman Warsh Tells Senate

The regulator asking for a password it doesn't have

Since Treasury Secretary Scott Bessent and then-Fed Chair Jerome Powell summoned the CEOs of Goldman Sachs, Morgan Stanley, Citigroup, Bank of America, Wells Fargo and JPMorgan Chase to Treasury headquarters on April 8 to discuss Anthropic's Mythos AI model, the story has moved from panic to triage. But one basic fact hasn't changed: the Federal Reserve still doesn't have access to the tool everyone is scrambling around, according to CNBC.

Mythos is Anthropic's frontier AI model, released on a restricted basis in April under a program called Project Glasswing. It scans software and finds security holes fast, faster than human teams, according to Fed Vice Chair for Supervision Michelle Bowman. That's the whole problem. A bank can use it to patch its own systems. A hacker can use the same tool to break in somewhere else.

Anthropic gave roughly 50 organizations early access, including JPMorgan Chase, Amazon, Apple and Google, CNBC reported. The Fed was not one of them. Three months later, it still isn't, based on new Chairman Kevin Warsh's testimony to the Senate.

Warsh's testimony to Senate Banking

Responding to questions from Sen. Jack Reed, D-R.I., Warsh said the Fed doesn't control who gets access to Mythos, but he hasn't held back sharing his views with the rest of the government.

"We are not the deciders as to who has access, but I have not been shy in sharing my views with authorities across the government about the vulnerabilities, and have been asking for access not just for the Federal Reserve but for other institutions to a whole range of these new artificial intelligence models so that they can protect themselves," Warsh told the committee, according to CNBC.

Warsh added he didn't want to single out Mythos. "As these new models find their way more broadly, our banking system and frankly, the Federal Reserve needs to do all we can to patch any vulnerabilities that we have," he said.

That's a notable admission from the man now running the central bank. The institution responsible for overseeing the safety of the U.S. banking system doesn't have the tool it says it needs to do that job, and doesn't control the decision to get it. Anthropic didn't respond to CNBC's request for comment on the matter. The Fed declined to comment for that story.

The regulatory scramble underneath

While the Fed waits, its own rulebook has already moved. On April 17, the Fed, the Office of the Comptroller of the Currency, and the FDIC quietly issued SR letter 26-2, narrowing existing model risk management guidance so it no longer covers generative or agentic AI, the kind of system Mythos is, according to briefs.co. Bowman, who chairs the Financial Stability Board's Standing Committee on Supervisory and Regulatory Cooperation, said the old rules simply don't fit tools like Mythos, and that the FSB plans to release a draft of new international guidance for public comment in the third quarter of this year.

Regulators have also pulled back from the exam room itself. The Fed and OCC are pausing some cyber-related examinations of the largest banks specifically to give those institutions time to patch the flaws Mythos is surfacing, Bloomberg reported, as covered by TNW. Officials described that as a deliberate tradeoff, not a retreat from oversight. Banks can't fix problems and simultaneously prep for an exam on those same problems.

On the ground, the response has been massive. JPMorgan Chase CEO Jamie Dimon said in May that the bank has "hundreds of people" working full time on Mythos-related patching, calling it "serious work," according to TNW. Goldman Sachs CEO David Solomon said during an April earnings call his firm is "working closely with Anthropic and all of our security vendors."

The tension nobody's resolved

Dimon has also pushed Anthropic CEO Dario Amodei to be more transparent. "The right thing [for] Dario and Anthropic [to do is] to lay it out, give people a chance to study it, understand the vulnerabilities, come up with plans so we can handle it," Dimon said at a livestreamed Anthropic event, according to Banking Dive. Amodei has acknowledged Mythos creates a "moment of danger" by exposing vulnerabilities before they can all be fixed, which is why Anthropic decided against a full public release.

Dimon, notably, called the cybersecurity risk from AI "a temporary thing" during what he described as a "transitory period." That's a defensible read: if patching catches up to discovery, the danger window closes. But it assumes the discovery pace doesn't keep accelerating, and it assumes every institution with access acts responsibly. Neither is guaranteed. Bowman herself has said the model "accelerates the process of detecting cyber vulnerabilities" in ways that cut both for defenders and attackers.

There's no indication any bank has been breached using flaws Mythos found. There's no indication Anthropic did anything wrong by restricting Mythos rather than releasing it broadly. What's established is narrower and still striking: the Fed, the agency charged with keeping the banking system safe, spent at least three months asking for access to the AI model at the center of the biggest cybersecurity story in banking this year, and as of Warsh's Senate testimony last week, was still asking.