Bessent and Powell call emergency meeting with bank CEOs after Anthropic's Mythos AI finds thousands of zero-day exploits

Treasury Secretary Scott Bessent and Fed Chair Jerome Powell reportedly held an emergency meeting on April 7 with CEOs of five major U.S. banks to discuss Anthropic’s Mythos AI model and its potential to accelerate cyberattacks. Anthropic says the model has found thousands of zero-day vulnerabilities and can autonomously chain exploits, raising concerns about systemic risk to banks that hold trillions in deposits and process payments for millions of Americans. The company is responding with Project Glasswing, giving select firms access to the model and committing up to $100 million in usage credits plus $4 million in donations to security groups.

Analysis

This is less a headline about one model than an inflection point for the cyber risk premium across financials: when regulators convene systemically important banks around AI-enabled exploitation, the market should start pricing a higher baseline of control failure, not just breach probability. The first-order losers are the most interconnected incumbents because their attack surface is broadest and their incident-response complexity is highest; second-order losers are firms whose business model depends on trust, uptime, and low-friction payments. The most underappreciated implication is that cyber spend may rise faster than revenue for large banks over the next 4-8 quarters, pressuring efficiency ratios even if there is no breach.

The likely near-term winners are the infrastructure vendors that sit inside the defensive stack rather than the banks themselves. AI-assisted offense creates demand for identity, endpoint, network segmentation, cloud posture, and log-analytics tooling, and the spend should bias toward vendors with measurable risk-reduction ROI and existing enterprise penetration. That favors broad enterprise security platforms and large cloud/security ecosystems over point solutions, while also creating a procurement tailwind for consulting and managed detection firms as banks outsource more of the 24/7 hunt function.

The contrarian view is that the immediate market reaction may overstate near-term monetization for cybersecurity names while understating the regulatory drag on bank multiples. Security budgets are sticky, but procurement cycles are slow; the revenue benefit is real yet likely lags the fear trade by months. Meanwhile, the bigger medium-term risk is operational: if even a modest AI-enabled incident forces one large bank to harden workflows, the industry could see slower digital onboarding, more step-up authentication, and worse customer experience — a quiet headwind to deposit growth and fee income rather than a dramatic single-day selloff.

Catalyst path: over days, expect elevated volatility and relative underperformance in the big-bank basket versus defensives; over months, watch for budget revisions, vendor commentary, and any supervisory guidance that effectively makes AI-resilient controls mandatory. The key reversal would be public evidence that the model remains largely contained to red-team use and that banks can deploy compensating controls without materially increasing opex. Absent that, the risk premium should remain in place into the next earnings season.

Key Decisions for Investors

• Short a basket of C/MS/BAC/WFC/GS vs long XLK or a cybersecurity-heavy basket for a 1-3 month horizon; thesis is multiple compression from higher perceived operational risk and rising compliance opex.
• Add tactically to MSFT, GOOGL, and CSCO on dips over the next 2-6 weeks; they are better positioned to monetize defensive AI/security spend through platform bundling than the banks are to absorb the cost.
• Consider long PANW or CRWD on any post-event pullback, but size for 3-6 month lag risk; these names should benefit as banks reallocate budget toward identity, endpoint, and AI-assisted threat detection.
• Buy downside protection on JPM and GS into earnings season via 2-3 month puts or put spreads; the immediate catalyst is not credit, but margin pressure from elevated cyber and compliance spending.
• If you want a cleaner relative-value expression, go long AMZN/GOOGL cloud-security ecosystem exposure against a basket of regional banks; cloud providers can monetize enterprise security demand while banks face the cost burden first.