The IMF spring meetings were supposed to be about trade policy. Instead, every closed-door session circled back to one word: Mythos.

Anthropic’s latest AI model has found thousands of high-severity vulnerabilities across every major operating system and browser on the planet. Not theoretical weaknesses. Exploitable ones. And it chains them together autonomously.

Finance ministers are terrified. The global banking system just became the softest target on earth.

What Mythos Actually Does

Mythos doesn’t just scan for bugs. It reasons about them. It discovers a buffer overflow in one system, a privilege escalation in another, and a logic flaw in a third — then stitches them into a working attack chain without human guidance.

No security tool has ever done this at scale. Mythos does it across platforms, simultaneously, and it doesn’t stop finding new ones.

The vulnerability count is already in the thousands. High-severity. Across Windows, macOS, Linux, Chrome, Safari, Firefox. The attack surface is everywhere.

Why Banks Are Uniquely Screwed

Here’s the part that sent the IMF into panic mode.

Banks don’t run modern infrastructure. They run COBOL. They run systems patched together over decades. They run middleware from companies that no longer exist, wrapped in layers of duct-tape integrations that nobody fully understands.

Canada’s Finance Minister said it plainly: the banking sector’s legacy stack is a liability that just went from theoretical to existential. The ECB echoed it. The Bank of England echoed it louder.

When your core transaction processing runs on code written before the internet existed, and an AI can autonomously find and chain exploits across every layer of your stack — you don’t have a cybersecurity problem. You have a survival problem.

Anthropic’s Response: Project Glasswing

Anthropic isn’t pretending this isn’t their mess. They launched Project Glasswing — a defensive initiative sharing Mythos-derived intelligence with 40 major companies to help them patch before someone else finds the same holes.

They also released Claude Opus 4.7, a model explicitly designed to be safer. It’s powerful, but it lacks Mythos’s ability to autonomously discover and weaponize vulnerability chains. The message is clear: here’s the tool you should be using, and here’s why.

Whether sharing the findings with 40 companies is sufficient when the entire global financial system is exposed — that’s a different question.

The Government Response

The White House is preparing to give six federal agencies direct access to Mythos for defensive purposes. The Treasury Secretary convened an emergency meeting with Wall Street CEOs and the Fed Chair. That meeting wasn’t on the public calendar.

The UK AI Security Institute is trying to keep things measured, calling Mythos “evolution, not revolution” in AI capabilities. Maybe. But evolution doesn’t usually cause emergency sessions at the IMF.

What Happens Next

The uncomfortable truth: every major financial institution is now racing to audit infrastructure that hasn’t been comprehensively reviewed in decades. Some of those systems can’t be patched without being rebuilt. Rebuilding takes years. Mythos exists now.

The vulnerability disclosures will trickle out through Project Glasswing. Patches will follow. But the fundamental problem — that the global banking system runs on ancient, brittle code — isn’t something you fix with a patch cycle.

Mythos didn’t create this vulnerability. It just made it impossible to ignore.