The Mythos Monopoly: Why One Bank’s AI Shield Risks a Crash

By C. Rich

JPMC & Claude Mythos: The Lone Bank in Project Glasswing

The inclusion of JPMorgan Chase as the sole banking representative in Anthropic’s “Project Glasswing” coalition marks a significant and potentially destabilizing moment in the evolution of financial cybersecurity. While the coalition is comprised of twelve heavyweights, including titans like Amazon, NVIDIA, and CrowdStrike, the banking sector remains conspicuously underrepresented. By granting JPMC early access to Claude Mythos, a Vulnerability Research (VR) engine capable of discovering and weaponizing “zero-day” exploits with a 72.4% success rate, Anthropic has effectively allowed one institution to begin a process of “automated hardening” that its peers have yet to touch. This creates a stark “survival gap” where JPMC, backed by its $17 billion technology budget, is vaccinating its internal ledgers and transactional code against AI-driven attacks that other institutions are not yet equipped to see, let alone defend against.

As of today 4/10/26, this imbalance is deeply unnerving because of the “Slowest Gazelle” principle in cybersecurity. If Mythos-class models, or the exploits they generate, were to leak into the hands of bad actors, hackers are unlikely to beat their heads against the Mythos-hardened defenses of JPMorgan. Instead, they will pivot toward the other “Big Four” institutions, such as Bank of America, Wells Fargo, or Citi, who are currently absent from the Glasswing list. In a hyper-connected global economy, the security of a single bank does not guarantee the safety of the system. A successful AI-driven exploit against a non-hardened bank could trigger a liquidity crisis or a systemic bank run that would inevitably impact the entire financial landscape, regardless of how secure JPMC stands in isolation.

The absence of other major banks likely stems from a combination of Anthropic’s own “containment” strategy and the varying speeds of corporate risk assessment. Anthropic has limited the circle of partners specifically because Mythos is deemed too dangerous for a broader release. JPMorgan’s presence is likely a result of Jamie Dimon’s aggressive stance on AI as a critical risk and the bank’s deep infrastructure ties with AWS. While other banks may be waiting for these security fixes to trickle down through third-party vendors like Microsoft or CrowdStrike, the delay creates a window of vulnerability. In the high-stakes world of global finance, being the only institution with a cure to a digital contagion is just as unsettling as the contagion itself, as it highlights the fragility of the peers left behind.

Buy Book: DEEPFAKES: A Guide for Teaching Seniors to Spot Deepfakes & Fraud