Trump officials may be encouraging banks to test Anthropic’s Mythos model

Treasury Secretary Scott Bessent and Fed Chair Jerome Powell reportedly urged major bank executives to use Anthropic’s new Mythos model to identify vulnerabilities, while JPMorgan, Goldman Sachs, Citigroup, Bank of America, and Morgan Stanley are said to be testing it. Anthropic is limiting access because the model is unusually effective at finding security flaws, adding to scrutiny as it simultaneously faces a U.S. court fight over its Defense Department supply-chain-risk designation. U.K. financial regulators are also reportedly discussing the model’s risk.

Analysis

This is less about a single vendor win than about the emergence of a de facto regulated benchmark for AI-assisted security testing in banking. If large banks standardize on a frontier model for vulnerability discovery, the near-term winner is the platform with the best enterprise trust envelope and governance controls, not necessarily the best raw model. That favors incumbents with distribution into regulated workflows and creates a subtle moat around whichever provider gets embedded into model risk management, audit, and red-team processes.

Second-order, the banks themselves may see a modest reduction in marginal cyber labor spend, but the larger impact is on security vendors and consultancies that monetize manual testing and alert triage. Over 6-18 months, AI that finds weaknesses faster should compress low-value managed security services while increasing demand for remediation, code hardening, and continuous control monitoring. The real operational risk is that better offensive tooling increases the speed and quality of attacks too, so any productivity gain inside the bank can be offset by a parallel rise in adversary capability.

The regulatory layer matters more than the headline suggests. If central banks and regulators are implicitly blessing AI-assisted vulnerability discovery, the compliance question shifts from "whether to use AI" to "which models are approved and under what controls," which could slow procurement and create a winner-take-most dynamic among a few vendors. However, the litigation backdrop means any policy reversal or adverse ruling could quickly reintroduce supply-chain concerns and force banks to diversify away from the current favorite, making this a fast-moving governance trade rather than a pure product-cycle trade.

Consensus is probably underestimating how binary this is for enterprise adoption: either the model becomes a standard security layer in bank ops or it gets constrained by legal/regulatory friction. The market may also be over-focusing on the AI vendor and underpricing the spillover to cyber insurers, security software, and incident response firms, where better detection can paradoxically raise near-term claim frequency as more issues are surfaced before being fully remediated.

Key Decisions for Investors

• Long JPM vs short a basket of high-beta cyber services/consulting names for 1-3 months: JPM has the strongest probability of being the first mover in regulated AI security workflows, while labor-arbitrage vendors face margin pressure as AI triage scales.
• Buy a small basket long GS/C/BAC/MS on a 3-6 month horizon only if there is follow-through from formal bank policy adoption; otherwise fade the move because the near-term benefit is more reputational than financial.
• Watch ANET/CRWD-style security infrastructure names for a post-announcement lagging bid, but avoid chasing until procurement language turns into budget line items; the setup is better as a 6-12 month secular hold than an event trade.
• Consider a long cybersecurity infrastructure / short IT services pair if banks increasingly automate vulnerability discovery: the beneficiaries are software and controls, while lower-end manual security spend is the most exposed.
• Set a legal/regulatory alert on the Anthropic litigation and U.K. regulatory commentary; any adverse ruling or supervisory pushback would be a fast catalyst to sell the AI enterprise trust complex and re-rate the procurement timeline by 1-2 quarters.