Will Mythos Ruin or Save the Global Financial System?

0:00For many men, mental health challenges aren't recognized until they've already taken a toll. Work pressure, financial stress, changing relationships, and traditional expectations around masculinity can quietly wear men down, often without clear warning signs. In Season 3 of The Visibility Gap, Dr. Guy Winch and his guests explore how these pressures show up, how to spot them earlier, and how men can access meaningful support. Listen to the new season of The Visibility Gap, a podcast presented by Cigna Healthcare. Find home wherever you roam at Sonesta ES and Simply Suites, where longer stays feel comfortable, flexible, and easy.

0:38Stretch out and enjoy spacious accommodations and home-like amenities designed to help you settle in and stay productive or relaxed for however long you need. And when you're a Sonesta Travel Pass member, staying at Sonesta ES and Simply Suites means earning points toward free nights, upgrades, and more with every eligible stay. Go to Sonesta.com to book your stay and unlock the best rates with Sonesta Travel Pass. Here today, Rome tomorrow. Join now at Sonesta.com. Terms and conditions apply. The thing about AI for business, it may not automatically fit the way your business works.

1:12Stephanie Flanders:At IBM, we've seen this firsthand. But by embedding AI across HR, IT, and procurement processes, we've reduced costs by millions, slash repetitive tasks, and freed thousands of hours for strategic work. Now we're helping companies get smarter by putting AI where it actually pays off, deep in the work that moves the business. Let's create smarter business, IBM. Bloomberg Audio Studios. Podcasts, radio, news. As this tech evolves, we may need to have a more standardized process for if there is a systemically important development in the tech. There is an actual process for deciding who gets access.

1:55It's done in a more democratic way, in a more equal way, and that's a hard thing to happen.

2:09Stephanie Flanders:I'm Stephanie Flanders, Head of Government and Economics at Bloomberg, and this is Trumponomics, the podcast that, as ever, looks at the economic world of Donald Trump, how he's already shaking the global economy and what on earth is going to happen next. And this week's episode is being recorded a bit early on Thursday, the 16th of April in Washington, in the middle of the spring meetings of the International Monetary Fund and World Bank, where an AI model that few of the officials here had probably even heard of a week ago is threatening to upstage even the conflict in Iran as the subject everybody wants to discuss.

2:44Stephanie Flanders:It all started with a Bloomberg story a week earlier revealing that the US Treasury Secretary, Scott Besant, had gathered Wall Street bank leaders to warn about Mythos, the latest AI model from Anthropic, that it was so powerful that it could herald a new era of cataclysmic cyber attacks carried out autonomously by bots. That meeting, called at short notice, set off alarm bells with central bankers and regulators around the world who all then rushed to arrange their own meetings to understand how this model and others like it could raise a new level of systemic threat. But as with most things AI, the answer turns out to be a bit complicated because the same people who tell you how dangerous this new model is, a model Anthropic itself has said is so powerful it's only making it available to a select group of firms, will also tell you it's going to be the best security against cyber attacks we've ever had.

3:41Stephanie Flanders:So, frightened, relieved, perplexed, how should we feel about mythos? And does the stability of the world financial system and the broader economy really rest on the answer? Well, we thought it was worth getting some kind of debate going on that with Laura Noonan, global finance and regulation reporter who's been in DC chasing this story, but is normally based in London. Laura, welcome to the show. Thank you. And Michael Dung is the Geoeconomics Technology Analyst at Bloomberg Economics, and he's previously served as a policy advisor and presidential management fellow in the CHIPS program office at the Department of Commerce.

4:16Stephanie Flanders:Michael, welcome back. Great to be back. Our colleagues actually wrote a big explanatory piece on the day that we're recording, which sort of painted a picture of the testers inside Anthropic, who over the last, I guess, few months have been waking up to the extraordinary and potentially quite frightening power of this new model, Mythos. Michael, what is it, I guess, we should get to basics on it? What's special about it? Mythos is Anthropic's newest model, and in particular, the capability that set off alarm bells is its ability to autonomously discover vulnerabilities on a scale that we haven't seen before.

4:53So this capability in itself isn't brand new. If you look at Cloud Opus 4.6, which is the model immediately preceding this, They did show early signs of this capability in terms of finding 500 zero-day exploits, which are exploits that the developers didn't know about, and vulnerabilities that attackers could exploit.

5:10Stephanie Flanders:So zero-day is, you have zero days to fix them because you didn't know about them. Exactly, yes. And those tend to be the most devastating used by hacker groups and even nation states. And generally the idea is that many of them hold a repository of them to use at certain times. Opus 4.6 already demonstrated the ability to find some of these. The difference with Mythos is its ability to find many more of them. autonomously at a speed we hadn't seen before. And in many cases, one of the anecdotes was they had researchers who did not have security training, essentially, instructed to run overnight, and the next morning when they came back, it had found a lot of vulnerabilities.

5:41And it's that ability to find vulnerabilities in much of the code and infrastructure that underpins the internet, our financial system, across every major operating system, internet browsers, etc., that I think really is scaring people.

5:53Stephanie Flanders:We're going to get into the double-edged nature of this, because if you can find the vulnerabilities, sees them maybe as long as the system is in the right hands, you could potentially fix them ahead of others. The reporting we had on this, one of the paragraphs jumped out at me when they were doing this testing, is that Mythos orchestrated the digital equivalent of a bank robbery, getting past security protocols and through the front door of networks, breaking into digital vaults that gave it access to online treasures. AI had picked locks, but now it could pull off an entire heist. Yes, I think that's a great demonstration of where we are in the frontier, right?

6:28And so previously when you just had the models alone, they were sophisticated, they could program, they could write code well, etc. If you've heard all the chatter over the past year about agentic systems, this progress that we've seen specifically in Mythos is a perfect demonstration of that, the ability to act autonomously, chain together independent actions. And I think even more so than finding specific vulnerabilities, that ability to chain together minor exploits into a significant attack campaign is what has researchers most concerned, because that's the ability that's most difficult to guard against.

6:55One of the most popularly circulated Graphics, which was at the top of Anthropics release article talking about Mythos, was looking at Firefox exploits, in which they compare something like Mythos found 181 ways to exploit Firefox versus two from 4.6. But the key there was the 181 in many cases relied on two vulnerabilities specifically. But Mythos specifically using those two was able to find a variety of ways to attack the browser. And that sort of demonstrates the greater latitude of action that this model has versus predecessors.

7:25Stephanie Flanders:In some ways, this is an unusual thing for us to be talking about because we're getting into kind of high tech. But of course, we're also AI is infiltrating so many different parts of our world now. That's why we would have to talk about it. But Laura, when you came to these meetings, you say in a piece that you've been writing that you might have expected potential for World War Three or certainly major developments in Iran, which are causing enormous economic ructions to be the dominant topic this week in Washington. But they have been a little bit hijacked by mythos. Yeah, I mean, in terms of the people who are here from a pure financial sector perspective, so we're talking about the governors, the financial regulators, the banks themselves, the people who are interested in the pure financial sector stuff, the main risk everyone's been talking about has been mythos and what it could mean for the financial sector.

8:13And it has been fascinating to watch it evolve because these are people who feel very well versed in understanding financial risks. They could talk to you about the model underpinning bank capital all day long. These kind of models are brand new territory for them. I think they'll actually benefit a lot from listening to our colleagues' comments here, because the level of understanding is just not there. And they read this thing, they think it's big, it's scary. They don't know how it's going to work out. And if you hear the idea that it could do an entire bank heist in like five minutes, 10 minutes, that is terrifying for the people whose job it is to protect the financial system.

8:45Stephanie Flanders:Cyber risk, cybersecurity, must be something that you have been hearing about in these circles for a while. I'm certainly very struck when you talk to the heads of banks or others, they will reveal just the amount of money, the amount of individuals they have focused only on deterring cybersecurity risks on a given day. They paint a picture of an onslaught on the bank's security systems on their websites daily that's just been a fact of life for years. Shouldn't they be on top of it by now? I think part of the thing is they feel like they have been spending a lot of time on this, and this has still caught them somewhat unawares, even though they knew there were cyber risks.

9:23I think it's the escalation, the fact that this could all happen so quickly. And I think some of them have been somewhat blindsided by this, because certainly there is a lot of focus and has been for a long time. And people have been warning about cyber risk. But it's hard to get people to really understand it until it becomes a real and a present danger. So there were some similar conversations going on around the quantum computing capacity. And people have been concerned that when we have whole scale quantum, that's going to lead to a great escalation around cyber attacks. And people were thinking about that, talking about that.

9:55But it was seen as something which is going to become a reality in 5, 10 years. So I think the idea that there would be this step change in cybersecurity demands so quickly is what's called people unawares. And also, the financial system hasn't got very good tools to deal with this in a harmonized, unified way. And that's also been a feature of some of the conversations this week.

10:16Stephanie Flanders:And Michael, even as we've had this conversation, and I noticed it even in the coverage over these last few days, we had the story that I mentioned at the top about Treasury Secretary ushering in banks. And it was understood to be him warning about this model. But actually, it turns out it was also about encouraging banks to use this model to identify the risks and the holes in their system ahead of others because it's so good at identifying weaknesses. So I guess it does raise this question, is it a threat or is it actually something that's going to make us safer, this kind of model? So absolutely both.

10:55And I think a lot of it depends on the timing itself. So in the immediate short term, it's much more of a threat just because things are changing so quickly. And the velocity, the speed of the threat environment has accelerated so dramatically. And so one of the things is for the attackers have always had a structural advantage, let's say pre-AI, in the sense that they could choose a time and place where they attack and they only need to succeed once. And defenders, as you already alluded to, banks, for example, face huge campaigns of attacks all over the place and they need to succeed 100 % of the time.

11:22And if they fail even once, then consequences could be catastrophic. What's changed with Anthropic, with Mythos now, is that you see this general upskilling of attacking capabilities across the board, right? That's the initial concern, which is that many people who didn't have the capabilities to attack top institution cyber defense teams could now use Mythos, assuming they get access to it in a year or so when this becomes public, to then attack institutions at a scale we've never known before. But in the long term, the reason this potentially could actually be a benefit is, again, as you discussed, there's huge potential for this to help defenders scan for vulnerabilities and close the sort of resource gap that they had with the attacking side.

11:59There was always a scale mismatch between attackers and defenders, but this helps close that scale for the defending side who also have an internal information advantage. They've always had this advantage as well, but were just never able to fully exploit it in the sense that they know their own systems the best. And once they have the scale and the resources that Mythos provides them to act on that information advantage, it actually means we could get a bunch more secure systems. They could find all the vulnerabilities, gradually patch them out over time. And once you patch a vulnerability, it's gone.

12:27So an attacker can no longer use that. So in the long run, you could see this certainly assuming banks and top institutions act quickly enough to look at their own vulnerabilities, which is what this Anthropics Head Start is giving them right now, then you could see this really benefiting the defense.

12:42Stephanie Flanders:There's often a discussion around economists saying that things will be fine in the long run. And then, you know, on the famous Cain's quote about in the long run, we're all dead. In the short term, it sounds like if you think the period of heightened risk is going to be when these models are out there, but it's not clear in whose hands they're in and the state of knowledge on the side of the banks is perhaps mixed, it seems like we're going to have quite a few bumps on the road to that more secure future that you just painted. Yes, absolutely. And even that more secure future is conditional on a lot of this AI being properly used and properly implemented and deployed across most institutions.

13:21One of the things I just discussed about defenders having an advantage is only true in the immediate short term for top institutions with access to these models, with the budgets and the cybersecurity teams to properly defend their systems and networks. A lot of these smaller banks, smaller institutions, smaller firms across the board, who in many cases even now don't have proper cybersecurity teams, are going to be even more exposed and vulnerable to heightened campaigns from attackers with much more skill and resources, assuming that they do get access to mythos in time. And in part, what needs to happen is I think the infrastructure providers for the internet, for the financial system, the top institutions themselves need to be much more proactive about pushing out updates and patches to make sure that most of these smaller institutions aren't running their own infrastructure, right?

14:06And so the infrastructure behind them needs to be more proactive and making sure vulnerabilities are fully addressed so that as a network effect, the totality of the system and the economy is protected. And that's what Anthropic is doing with Project Glasswing. In addition to their 12 launch partners, these top banks and institutions, they've added in 40 plus infrastructure providers because they know this is the quickest and fastest way to reach the most people.

14:26Stephanie Flanders:Laura, like the regulators, you're learning on the fly. You're not from our tech team, but I suspect you're going to get more and more by the hour, you're getting better informed on this. But just on that point of the sort of this double-edged aspect where you've got to be very frightened of this model, but you actually want to make sure that your own institutions get it first so that they can actually use it to spot vulnerabilities. The regulators that you listen to, are they getting their heads around that? I noticed that we had a story, you know, it does seem like some UK financial firms are going to get hold of this model.

15:04Stephanie Flanders:How is that playing? So it really has opened up an interesting debate about who gets access and who doesn't and also who decides because it's not actually for the Fed, for the Basel Committee, for the Bank of England to decide. This model is owned by a non-state actor so they can encourage but they don't really have a role there and the banks who are not currently able to access it which is everyone aside from the biggest US banks they do feel like they are at a disadvantage because they can't plan and they can't prepare and they're very keen to get access to it. There are some of the European officials who were here this week who are trying to softly encourage their peers in the US to encourage the US technology company, which owns the model, to give the European banks access.

15:47But there's no obvious process for that. So it's one of those things where as this tech evolves, we may need to have a more standardized process for if there is a systemically important development in the tech. There is an actual process for deciding who gets access. It's done in a more democratic way, in a more equal way. And that's a hard thing to happen. And one of the challenges for Europe is Europe hasn't exactly got a burgeoning tech industry itself. So to the extent that there are AI issues, they are likely to involve non-European companies. And that means that the European large companies who are effectively clients of these AI firms are not going to be at the front of the queue when it comes to getting assistance to dealing with these issues.

16:28And that is a challenge which Europe is very acutely aware of.

16:34Stephanie Flanders:So there's a lot of noise about AI, but time's too tight for more promises. So let's talk about results. At IBM, we work with our employees to integrate technology right into the systems they need. Now, a global workforce of 300 ,000 can use AI to fill their HR questions, resolving 94 % of common questions. Not noise. Proof of how we can help companies get smarter by putting AI where it actually pays off. Deep in the work that moves the business. Let's create smarter business. IBM. Support for the show comes from Public. Public is an investing platform that offers access to stocks, options, bonds, and crypto.

17:12And they've also integrated AI with tools that can assist investors in building customized portfolios. One of these tools is called Generated Assets. It allows you to turn your ideas into investable indexes. So let's say you're interested in something specific like biotech companies with high R &D spend, small cap stocks with improving operating margins, or the S &P 500 minus high debt companies. Chances are there isn't an ETF that fits your exact criteria. But on public, you just type in a prompt and their AI screens thousands of stocks and build a one-of-a-kind index. You can even backtest it against the S &P 500.

17:48Then you can invest in a few clicks. Go to public.com slash market and earn an uncapped 1 % bonus when you transfer your portfolio. That's public.com slash market. Ad paid for by Public Holdings. Brokered services by Public Investing, member FINRA SIPC. Advisory services by Public Advisors, SEC Registered Advisor. Crypto services by ZeroHash. Sample prompts are for illustrative purposes only, not investment advice. All investing involves risk of loss. See complete disclosures at public.com slash disclosures. Being a small business owner isn't just a career, it's a calling. Chase for Business knows how much heart and effort go into building something of your own.

18:24That's why they make business growth their priority. The Chase team takes the time to understand your mission, where you are now, and where you want to go. Their broad range of solutions is designed with you in mind so you can bring your ideas to life. From banking to payment acceptance to credit cards, you can conveniently manage all your business finances all in one place with their digital tools. Looking for tips and advice? Their online resources are always available to give you the solutions you need to help your business thrive. See how your business can get stronger and go farther with Chase for Business.

18:59Learn more at chase.com slash business. Chase for Business. Make more of what's yours. The Chase mobile app is available for select mobile devices. Message and data rates may apply. JPMorgan Chase Bank N.A. Member FDIC. Copyright 2026. JPMorgan Chase and Company.

19:20Stephanie Flanders:Michael, I mean, it's odd because Anthropic, you know, We had this news about Scott Besson, but of course, the main dynamic between Anthropic and the US administration recently has been around the arguments with the Defense Department and being categorized, whether it was legal or not, being categorized as a supply chain threat. How should we read that? The same administration that has said it's a supply chain threat has encouraged all of its contractors to stop using anthropic tech is also encouraging some financial firms precisely to use this tool. Have they just given up on the supply chain threat aspect?

19:58I, as well as many others, would find the supply chain risk designation questionable for anthropic.

20:03Stephanie Flanders:And that... The administration hasn't quite fessed up. Yes, yes. The specific use of anthropic and the argument over that in that context is very much about the Department of Defense not wanting to be constrained in any way in the use of anthropics model. The context for its wider use in the financial system and protecting many of our top institutions is much more about the capability of the model itself. It's the difference between scope of responsibility versus raw capability. And so in this case, I think even if you assume the supply chain risk designation was somehow entirely legitimate, you would still have to be careful about, let's say, a Chinese open-weight model that suddenly had this capability.

20:40You would still see the Treasury briefing all the top banks and institutions to make sure, are you aware of this threat? Are you preparing it that this is right? Are you actually using this to defend your own system?