Claude Mythos Access Gap: Fed Warned Banks, Then Waited Months

The regulator without the tool

In April, the Federal Reserve and the Treasury Department called an unusual meeting with the chief executives of the country's largest banks. The purpose was to warn them about Claude Mythos Preview, a new Anthropic AI model that officials believed could pose an unprecedented cybersecurity threat to major financial institutions. 1 Months later, the Fed itself had still not been able to use the model. According to CNBC, the central bank went at least three months without access to Mythos Preview and still lacked it as of mid-July. During that time, other institutions that did have access were using it to find and patch weaknesses in their own systems. 1

The situation is awkward for the Fed. It identified the risk and pushed the industry to act, but it could not examine the capability firsthand while some of the firms it supervises could.

What Mythos is, and why access is rationed

Claude Mythos is a series of large language models from Anthropic, and Mythos Preview was the first. Anthropic chose not to release Preview to the public, pointing to how well it finds software vulnerabilities. 2 Instead, beginning in April 2026, the company gave a select set of organizations access through an initiative called Project Glasswing, so they could scan critical software for security flaws. 12 Public knowledge of the model came earlier: the Mythos name became known through a leak in March, before the formal announcement. 2

Anthropic widened availability in June without fully opening it. It released Claude Fable 5, described as a "Mythos-class" model for general use with safeguards attached, alongside Claude Mythos 5, a restricted version of the same underlying model with some of those safeguards removed. 2 Anthropic says the two are identical apart from their safeguards. When Fable 5's classifiers flag a request involving cybersecurity, biology and chemistry, or model distillation, the less capable Claude Opus handles it instead. 2

This matters for the Fed's position. The model became broadly available in June, but the public version is designed to hand off exactly the kind of security work that worried regulators. In practice, the vulnerability-hunting capability stays limited to whoever Anthropic admits to its restricted tiers. Even after the June release, the Fed's gap appears to have been a gap in the capability that mattered.

A pattern beyond Washington

The Fed is not the only institution facing this problem. Reuters headlines from mid-July describe the same tension in several countries and organizations:

• UK banks: A UK government AI adviser called British banks' lack of Mythos access a "wake-up call." 3
• Canada: Canada's financial regulator cited Claude Mythos in a warning to banks about cyber risk, according to an email Reuters obtained. 3
• The White House: The White House said the US would launch a coordination group for AI and cybersecurity. 3
• JPMorgan Chase: CEO Jamie Dimon called the risks from Mythos a "real issue." He said the US government is on top of it and that the model has prompted Washington to step in. 3

The reports describe one dynamic from different angles. CNBC focuses on the Fed's own lack of access. 1 Reuters shows the worry spreading through regulators and banks abroad, where lack of access is itself the alarm. 3 Dimon's comments add another view: the leader of the largest US bank is treating the threat seriously and also expressing confidence in the government's response. 3 That confidence sits uneasily with the fact that a central regulator spent months unable to test the tool.

Reading the episode

The main lesson concerns who holds the leverage. Anthropic decided not to release Mythos Preview publicly and to distribute it selectively. 2 That makes a private company the effective gatekeeper for a capability that public authorities consider systemically important. Regulators can call meetings and issue warnings, but under this arrangement they cannot assume they will get the tool before, or even alongside, the institutions they oversee.

The uneven access has a defensive cost as well. If firms inside Project Glasswing are patching vulnerabilities while others wait, the financial system ends up with an unevenly hardened attack surface. 1 The British adviser's "wake-up call" points to the same concern across borders. 3 Under this staggered model, defenders get stronger at different speeds depending on whether they are on Anthropic's list.

The new US coordination group could be an attempt to close these gaps, though the available reports do not say how it will handle access to models like Mythos. 3 Until access for supervisors is settled, the Fed's months-long gap stands as a clear example of a governance problem: frontier AI security capabilities are being distributed by vendors, while regulators are still working out how to get them.