TLDR
JPMorgan Chase CEO Jamie Dimon told Bloomberg Television that Anthropic's Mythos AI model multiplied global cybersecurity risk tenfold and exposed banks to vulnerabilities they had not previously encountered. Security researchers dispute the figure as unquantified and self-evaluated by Anthropic.
The verdict from the top of Wall Street
JPMorgan Chase CEO Jamie Dimon told Bloomberg Television that Anthropic's Mythos model increased global cybersecurity risk by roughly ten times and exposed banks to vulnerabilities they had not previously known about.[1] Dimon offered no methodology alongside that figure, just the number and a warning.
Dimon said he had already published his chairman's letter naming cyber as JPMorgan's single biggest risk, and that the risk assessment jumped tenfold once Mythos became available.[1] He said AI created vulnerabilities that banks had simply not encountered before. That claim is worth examining, because the arithmetic behind a tenfold multiplier is doing a great deal of work.
What Mythos actually is
Claude Mythos 5.1 is the same underlying model as Claude Fable 5.1, differentiated by cybersecurity and life sciences safeguards, and available only through Anthropic's Cyber Verification and Life Sciences Verification Programs.[2] Anthropic first previewed Mythos in April 2026 alongside a 244-page system card, which claimed the model autonomously rediscovered 181 full-exploit runs out of 250 trials across 50 crash categories.[6]
Security researcher Flying Penguin argued that the Mythos-specific claims are self-evaluated by the vendor, unquantified in the technical document, unreproduced by any named external party, and contradicted by the system card's own figures when read past the headline.[6]
Access controls and the export freeze
The US government issued an export-control directive on 12 June 2026 suspending all access to both Fable 5 and Mythos 5 for foreign nationals, forcing Anthropic to disable the models for compliance.[4] That directive came almost four months before Dimon's Bloomberg interview.
Anthropic controls Mythos access through Project Glasswing, its restricted-access initiative for vetted organisations. Financial-services firm FIS joined Glasswing to deploy Mythos for defensive security work, and FIS says its security posture draws on active engagement with the Financial Services Information Sharing and Analysis Centre and the Financial Services Sector Coordinating Council.[3] The dual-use problem sits right there: the same model a bank uses to find its own holes is the one Dimon says adversaries are using to find them first.
The defender's counter
Vinnie Liu, CEO and co-founder of security firm Bishop Fox, said that AI makes capable security researchers more effective while enabling less skilled practitioners to produce polished but inaccurate output at scale, and that the reconciling variable is the harness built around the model and the expertise of the person driving it.[5]
That cuts both ways for Dimon's thesis. If the harness and the operator determine the outcome, restricting Mythos to vetted programs through Glasswing is the right lever to pull, and the tenfold figure becomes a function of who gets access and what they build around it rather than a fixed property of the model itself. Anthropic's September 2026 release formalised Mythos 5.1 alongside Fable 5.1, keeping the verification requirement in place as the primary access gate.[2]
KEY TAKEAWAYS
SOURCES & CITATIONS
FREQUENTLY ASKED QUESTIONS
