Mythos and the Myth of Zero: Why Banks Need to Stop Chasing a Clean Vulnerability Backlog

Banking technology was built like a sprawling, constantly occupied building — designed for scale, uptime, and continuous use. It was never unsecured.  

Doors had locks, hallways had cameras, and certain rooms required badges and an escort. If a door was found unlocked, there was a repeatable process to lock it.

That process was often risk-based. When a patch wasn’t available, there was a methodical approach to apply compensating controls while remediation caught up.  

That’s normal banking discipline. And it worked when the pace of discovery was human.

Anthropic’s frontier AI model Claude Mythos changed that, surfacing vulnerabilities faster than any remediation process was built to handle and giving adversaries a window to act before defenses can close it.

The old bargain: find the weakness, fix the weakness

For most of the last decade, vulnerability backlogs were managed through a standard patch process, change control, and validation cycle that even regulators came to accept.

Regulators reinforced that model with expectations around cyber hygiene, disciplined testing, and tightly governed patch management. The New York State Department of Financial Services (NYDFS), for example, embedded vulnerability remediation and change control directly into its cybersecurity examinations.

But as anyone who has lived through a core upgrade, a weekend patch window, or a fragile legacy dependency knows, some doors can be shut quickly while others require more force and effort.  

Closing them without preparation can interrupt payroll runs, settlement chains, underwriting workflows, and customer access. That's exactly what resilience programs are designed to avoid.

Institutions have always worked with a risk and vulnerability backlog. A well-defined risk management process was followed to deal with it. Mythos makes the backlog impossible to ignore and renders the old process obsolete

The new reality: discovery has gone machine-speed

During controlled testing, Anthropic’s Mythos Preview autonomously surfaced thousands of previously unknown vulnerabilities across major operating systems and browsers. Many had existed undetected for decades.  

What previously required specialist teams and extended audit cycles was compressed into a single model-driven pass.

On JPMorgan Chase's earnings call, CEO Jamie Dimon described AI as a double-edged sword. He said Mythos shows that a lot more vulnerabilities need to be fixed.

He's right. But the more important question is what happens to the ones that don't get fixed in time.

The Verizon 2026 Data Breach Investigations Report shows attackers typically reach mass exploitation of newly disclosed vulnerabilities within roughly five days. Full remediation in regulated sectors often takes weeks longer.  

The gap between discovery and patch has always existed. Mythos just made both sides of that gap visible at the same time.

In banks, the doors were always there. Now they're tagged, mapped, and exploited faster than the building can be renovated.

The question has changed

For years, vulnerability conversations were framed as a race: how fast can you patch?

Now, institutions asking the right question are asking something more operational: if this isn't patched tonight, how far can an attacker spread through our network?

It's the difference between a security model built on perfect prevention and one built on bounded consequences. And it shows up in how regulators are increasingly framing their expectations.

OSFI B-13, for example, emphasizes threat-led testing that reflects the same instinct: real-world containment.  

The Bank of England has been direct that cyber risk evolves alongside defenses and doesn't simply go away. Resilience has to be something you build, test, and refresh.

The regulatory threat conversations are converging on the same point. Most vulnerability programs haven't caught up.

Why “extreme but plausible” is the missing link

While access to Mythos is currently controlled, it won't stay that way for long.  

Frontier AI will catch up and commoditize this capability. When it does, the asymmetry flips permanently. Attackers will be able to identify and weaponize vulnerabilities faster than any patch cycle can respond.

This means institutions need to stop organizing your security posture around a finish line that no longer exists.

The scenario banks are now planning for is an AI-enabled attacker moving through a tightly interconnected banking environment — payment systems, settlement engines, customer-facing channels, and shared infrastructure — before detection tools flag anything unusual. This makes breach containment the only viable security strategy.

Banks already have more going for them than they sometimes acknowledge:

• DORA stress testing
• CBEST simulations
• Scenario planning

These frameworks exist precisely because regulators understand that eventual compromise is part of the threat model. The question they're asking is whether you've designed your environment to survive a breach.

The practical shift: from patch velocity to blast radius

Vulnerability management needs a second axis.

The first axis is the one you already have, including severity, exploitability, and asset criticality. The second axis is the one most programs are missing: lateral movement potential.  

If this vulnerability is weaponized tonight, what can an attacker reach from here? What’s one hop away? Two?

Not every vulnerability is equal in probability, and not every vulnerability is equal in blast radius. A flaw in an internet-facing authentication layer on a core payment rail is categorically different from one in a legacy reporting system that hasn’t touched production in three years.  

The risk is the pathway, not the vulnerability.

The institutions getting this right aren’t necessarily patching faster but architecting so that the unlocked doors open onto hallways that go nowhere important.

What this means for banking CISOs right now

Mythos is a mirror. It reflects back a landscape that already existed, with thousands of vulnerabilities, many of them old and quietly tolerated. And it asks whether your program was built for that reality.

The response is to get ruthlessly clear on two things. You have to know which vulnerabilities, if exploited, can become systemic and what architectural controls limit that blast radius regardless of patch status.

That’s the work now: containment by design.

Want to learn more about how Mythos will effect the financial industry? Read our fact sheet.