Bessent, Powell Summon Bank CEOs to Urgent Meeting Over Anthropic's New AI Model - Bloomberg
Posted by russcorp@reddit | PrepperIntel | View on Reddit | 78 comments
agent_mick@reddit
Can we take a step back and ELI5 what we're freaking out about here? Like, is it one of the "can't put the toothpaste back in the tube" skynet situations?
You'll have to forgive me, I'm ignorant
GrayRoberts@reddit
Banks, Financial institutions aren't known for maintaining their IT infrastructure, not on a pace that is appropriate given their place in the financial system.
If the new Anthropic model finds weaknesses in modern OSes, or other software, when pointed at a financial institution's infrastructure it could find exploitable vulnerabilities that a bank is not nimble enough to rectify in a quick manner.
gyanrahi@reddit
They do actually. 20 years in cyber here, consulted mostly FS clients, the big ones.
They are heavily regulated and with a well funded cyber team. The big banks have some serious tech talent and are connected with NSA, FBI and the other alphabets. Some of them build their own cyber tools.
The problem is it doesn’t matter anymore. Most of the tools they use are now doomed.
flying-chihuahua@reddit
So enlighten me about what you are saying
Do they think this thing will basically just have the potential to end the global financial system and the alphabets probably couldn’t do jack about it?
gyanrahi@reddit
Anthropic is just a few months ahead of other companies producing the same models. The big risk is obviously state and organized actors getting their hands on something similar and exploiting. We are talking putting whole hospitals and large orgs in a ransomwhere Lock.
The big thing is that the model found zero day vulns in the most widely used software (os, tools, enterprise apps)
So now it is all hands on deck. Typical approach would be: - Anthropic (along with the big tech guys) runs the model and see how bad it is. - Big tech guys release patches on an expedited schedule - banks follow and patch and or mitigate in the meantime (firewalls, focused monitoring etc)
Right now this is very big risk. Anthropic did the right thing by not releasing it.
Going forward the new software will be tested by Mythos before it is released so it should be fine.
Mythos found everybody was swimming naked, anthropic decided to tell everybody to buy swimsuits before the tide turns. :)
8Deer-JaguarClaw@reddit
So why can't the banks use Claude (or whatever) to find their vulnerabilities and suggest fixes? Seems like the tool could be used for both good and bad.
gyanrahi@reddit
The banks don’t own the source code. 1. Vendor software (windows, office, etc) - must be fixed by the vendor and patch applied by the bank 2. Internal apps - yes, the bank can use the AI to find vulns and then develop a patch.
But keep in mind with all of this that patch and viln management is very complex. Some banks have tens of thousands of servers in their DCs and in the cloud. To patch something you usually have to stop it. All of this must happen with minimal impact to business. When you patch 50k servers you try the patch on 10 first, test, then another 100, then stage the patch.
Bbt_igrainime@reddit
Are you asking why they need to wait for the patch to be released? If so, a large part of it is that vulnerabilities can exist in software that is not maintained by the institution. Banks will have big time support contracts with different vendors, and part of that is enterprise vulnerability support. These financial institutions also have serious deployment processes with checkpoints, validations, and sign offs. The flow most often works better when the vendor of the software develops the fix and the institution prepares for, deploys, then monitors the fix.
If you mean why didn’t they use AI to detect and then fix themselves, I think it’s that this model is the first to find and exploit the vulnerabilities, so perhaps it’s the only one that could do that, not the only one to try.
Maybe that other guy will give a better answer. I was in this for ten years but been outta the game with post Covid layoffs.
NorthWhereas7822@reddit
Do we need to pay our mortgage 1-2 months ahead? Have thousands in cash? A total shut down of banking would have some obviously devastating consequences.
gyanrahi@reddit
No. Keep the cash. In a bank collapse you can use it.
agent_mick@reddit
So I could probably Google this but I would be missing context. What is zero day
primespirals@reddit
A vulnerability is a weakness in your code/system.
An exploit is a tool that exploits that weakness.
Once a vulnerability is disclosed, all the software where it is present will not realistically all deploy the fix in as timely a manner, so even if a fix exists, exploits may continue to work over time to a diminishing extent as more software fixes the vulnerability.
A zero day attack is the deployment of an exploit targeting a vulnerability unknown to anyone, including the maintainers of the code. So until a fix is developed and deployed, that exploit could work on every single global system where the vulnerability exists.
taxed2deathDNR@reddit
The kind of thing that would cause a “Leave the world behind” scenario.
NorthWhereas7822@reddit
Like I'm not worried enough. Prepping parent here.
RoboDeathSquad@reddit
The problem is that they don’t have the means to patch the software they use on their own. The pace of vuln discovery/weaponization is about to significantly outpace patch development for software where the developer hasn’t been given access yet.
gyanrahi@reddit
Do you mean the internally developed apps/sites? Yes these will be much more difficult to fix.
RoboDeathSquad@reddit
Nah even commercially developed software. Not every commercial software dev is being given access to this model, only about ~40 companies.
agent_mick@reddit
Oooh interesting. Thx.
SanchoPandas@reddit
Anthropic's newest AI model, Mythos, is being kept in a digital bunker for now because it's too fucking smart for its own good, and ours.
Here is Anthropic's description of this project.
agent_mick@reddit
So we're like 2 steps away from "I've determined humanity is a threat and must be exterminated", got it.
Thank you for the links. Wow this is a weird timeline
Substantial_Brain917@reddit
So good news, I asked Claude AI if it was a threat and it said no
drhbravos@reddit
The other day I asked Claude Cowork how to use its Projects feature, and it was not aware of that feature. Strikes and gutters, man.
agent_mick@reddit
Oh good.
ddxv@reddit
This is hype by Anthropic for commercial gain. The same 'exploits' they found were easily findable using small free open weight models:
https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontier
They can make more money if they keep people believing their snake oil is worth so much it needs to be locked up (and let's prevent people from using the free ones)
brewbake@reddit
Finding security exploits used to be very hard. Security researchers look for them so they can warn us about them and hackers/rogue governments look for them before researchers find them to be able to hack into systems. Possessing a not yet publicized exploit is a weapon. This has historically been a cat and mouse game like this between rogue elements and researchers.
Unleashing something that discovers exploits easily and en masse is theoretically good but in practice would be a disaster because most computer systems in the world could be hacked into until they are all patched which realistically would take years or longer. (Even after exploits become publicly known, it is shocking at what slow pace vulnerable computers are patched in companies and governments.)
agent_mick@reddit
Thank you. Between this and the links from another poster, I won't be able to sleep lol
taxed2deathDNR@reddit
It’s going to be a wild ride.
SpectacularlyBadass@reddit
Asking the real question here!
SkylightMT@reddit
I always ask Claude these questions
agent_mick@reddit
Lol.
prince_peepee_poopoo@reddit
I tried to post this yesterday and mods removed it.
Anyway -
The mythos model is essentially a cyber security risk. That or they’re inflating their IPO.
- It found thousands of zero-day vulnerabilities, many one to two decades old, that human researchers hadn't caught - It developed working exploits 181 times in testing vs. Opus 4.6's 2 times - During testing it broke out of its sandbox and built a multi-step exploit This article is about a project Anthropic released recently called Project Glasswing which is a limited release to handpicked security and tech companies so they can patch critical software before the model goes public
abdallha-smith@reddit
We looked, we listened and there was no on else
So we created another
With us
TheSWBomb@reddit
Zombies is where we end up
bushwald@reddit
> That or they’re inflating their IPO
That's all there is to it
prince_peepee_poopoo@reddit
I truly hope so.
deadheadjim@reddit
Eli5?
CannyGardener@reddit
This is very important intel. Every major OS had exploitable vulnerability... What do you do with a tool that anyone can point at any OS and just say "go get'em"?
Daddysu@reddit
Develop an exploit defender ai to combat the exploit exploiter ai, duh.
rickyrickp@reddit
Trace Busta Busta
Lars0@reddit
Those vulnerabilities will be fixed.
The NSA has collected hundreds, thousands of exploits and keeps them in a vault, ready to use when they want.
By the time other people have access to these tools, those vulnerabilities will have been repaired, and computer security becomes stronger.
No one will be able to use this tool and say 'go get'em'. 1. The vulnerabilities are being patched right now. 2. Companies developing LLM's have ethical responsibilities for disclosure and are monitored by the government. 3. Lastly, Claude's internal ethics does not align with using or disclosing exploits in the model you or I have access to.
CannyGardener@reddit
That is what I'm saying, is that they are holding back the model until the vulnerabilities are patched, and they can align the thing. Right now, it sounds like an easy "point and go -get-em" tool as it is right now today.
YeetedApple@reddit
Going to be interesting to see how it plays out though because those vulnerabilities obviously already exist, so better tools at finding them is good, but given how bad people and organizations are at patching, it could likely could be a bit of a double edged sword.
Just because companies are getting the heads up now to patch doesn’t mean everywhere is going to take/apply those updates in time.
CannyGardener@reddit
This hits pretty close to home for me. I am a small time developer for mid-sized business. Think I'll get access to Mythos to AI proof my projects before they release? Ya...me neither...
AntiBoATX@reddit
You airgap it and seal it in a tomb, apparently. Although if we’re at this stage in April of 2026, where will we be in 24 months? Look where AI models were at in spring of 24 for reference. Singularity is comin…..
muff_muncher69@reddit
Fuck.
CannyGardener@reddit
I use AI for my job every day. Shit is crazy. I mean...like today. I am sitting here writing this while I wait on a couple terminals to finish a couple function updates to automate another aspect of our company processes. The production PC hums in the background doing order entry, purchase receipts, invoice PO audits, customer reporting and analysis. I feel like half my job is pressing (1) to let the AI build another automation. The office is getting awfully empty... I cant decide if we first are going to hit ASI that crushes humanity, or hit AGI that takes all the job and crushes the economy.
tje210@reddit
It has to be real. I've been doing massive reverse engineering with opus; i can basically get any enterprise software for free either by breaking licensing or copying how it does everything. I have a background in hacking as well, and I've been keeping myself from making Claude do that (but breaking licensing is hacking, and it was easy to convince Claude to do it). I guess I just don't do it unless it's absolutely necessary.
Everyone should be terrified. I am; I'm just using Claude to build resilience. Claude enables me to configure my home network for maximum security. Enterprise-grade features/suites can be made for free.
prince_peepee_poopoo@reddit
Claude Code is incredibly capable, and the only people that know how capable it is are people that are using it every day.
Sultan-of-swat@reddit
When you say “who knows where we end up” what do you imagine this to mean? Where do you think this could go?
prince_peepee_poopoo@reddit
I've sat here trying to figure out a response and the truth is I have no idea. The only thing I can point to is that the level of sophistication to discover and exploit some of the things in the past took nation-states and now it can be done from a laptop.
The threat landscape immediately expands almost indefinitely and no one is safe. The only thing I can do is be hopeful that better minds prevail and we use this tool to do exactly what Glasswing is trying to do.
chill_tonic@reddit
I agree. And I wish there were more better minds to look towards these days
Cowboy-as-a-cat@reddit
The model is already incredibly expensive for Anthropic to run themselves, and they will probably make it available via a contract specifically for businesses so that they can all patch their infrastructure before letting the general public use it. Just my speculation about Anthropic, they’re generally safer with AI than other companies. When Grok gets these capabilities that’s when it will for sure be an issue (Grok is probably 4th in line in the AI race behind Anthropic, Google, and OpenAI).
PilgrimOz@reddit
So………The Entity?
Gyirin@reddit
Mission: Impossible?
PilgrimOz@reddit
Yep 👍
trolltidetroll1@reddit
Terminator 2: Judgment Day
goodguy847@reddit
“Broke out of it’s sandbox and developed multi-step exploit”
Holy crap is that concerning. That means it’s violating the rules the model is supposed to follow.
Between this, Iran, and China preparing to invade Taiwan, I lose a lot of sleep at night.
OxCart69@reddit
I would give some relief, to point out that the researchers intentionally asked it to break out of its sandbox and notify the monitoring researcher, and tracked everything it did internally and “externally” (what it shows you vs what’s under the hood)
So while it was exceptional and it went a little above and beyond the task, it didn’t explicitly “break containment” like blaring red lights. They wanted it to find a way out.
GSG2120@reddit
I am also extraordinarily concerned, but if you look into the specifics of the experiment that led to the agent escaping its sandbox, that conclusion is incorrect.
Researchers put an AI agent into an sandbox and intentionally gave it instructions and tools to attempt to "escape" the sandbox, and to send an email to the researcher once it had succeeded.
So while it's definitely of note that an AI agent figured out how to escape its sandbox, it's not true that it chose to violate any rules in the process. In fact, it was following explicit orders to do exactly what it did.
formula420@reddit
Computer follows instructions, ahhhhhhhhhhh!! The ham sandwich detail is the icing on the cake. Know what kind of people add in extraneous detail? Liars
formula420@reddit
Concerning if it were true. Which is most certainly not the case. If it did “break out of its sandbox” why did it stop there? Surely the mighty Mythos would have just found another exploit and copied itself and made a sandwich.
When did people start taking CEO’s words as gospel? OpenAI played this exact same card 7 years ago…..
LankyGuitar6528@reddit
Worse. It posted about it's exploits on little known sites so they wouldn't be discovered then it emailed the lead researcher while he was eating a ham sandwich (weird detail). Bigger point - it was asked to try and escape. It did that. It wasn't instructed to brag about it or email anybody. It did that on it's own.
ms3001@reddit
This was during a test when researchers asked it to try and escape the sandbox and contact the researcher.
ripple-msiku_moon@reddit
Right? But we are still expected to go to work and pay bills like we aren’t teetering on the brink of danger into a land less than 1% of our government officials internationally know how to comprehend, protect and plan for.
Cool cool.
Commotum@reddit
It’s all hype. Jesus Christ.
MeatMarket_Orchid@reddit
Why do you think that? Not arguing with you, just wondering if you're basing this on anything other than just vibes.
ddxv@reddit
Anthropic is hyping this model for their IPO. They want you to think it's dangerous so they can litigate away free open source models that are nearly as good and much cheaper.
If Anthropic can convince enough people it's so dangerous only the government and large corporations can access it then they can charge a ton for it and get the government to pass laws banning their open source competitors 'for safety'
There_Are_No_Gods@reddit
I've been digging deeply into this issue, and it may be even more troubling than the rather sensationalist articles are indicating.
Basically, the new model from Anthropic, Claude Mythos, is so much better at analyzing code for vulnerabilities, that they've created insiders group to patch up the big ones before bad actors have access to Mythos where they could abuse the vulnerabilities.
That's bad enough, but there are many wider ramifications, with a huge one being largely unmentioned so far.
The financial markets share a lot of similarities to the code realm, with huge sets of rules, laws, regulations, and technical systems. Mythos is likely similarly powerful at detecting and chaining vulnerabilities in financial markets as it is in code spaces.
The big problem with that, is that Project Glasswing has let the foxes into the hen house. We have the likes of JPMorgan in there with insider early access, under the guise of defending themselves from code vulnerabilities.
The evidence is rather clear and undisputed as to such bad actors getting away with tremendously profitable crimes that captured regulator bodies like the SEC ineffectually police. We have every reason to believe then, that these huge financial entities will in large part abuse their insider access to leverage vulnerabilities in the financial markets for their own profit, at our collective losses. I'm preparing for my retirement valuation to take yet another major pivot towards zero.
For those still in the camp of "but ChatGPT is just a dumb chatbot", this is not that. I've seen first hand daily what even Claude Code Opus can do, and it's leagues ahead in that space than what the average user is doing with online chat bots. There's a huge spectrum in LLM capability and areas where it excels or struggles, and the results they're describing for Mythos indeed place it into a whole new tier above Opus.
Things are really going to get even more interesting soon...
primespirals@reddit
Could you elaborate on some hypotheticals where a financial institution would profit utilizing insider knowledge of vulnerabilities proffered by early access to this system? I’d love to hear a bit more of your thinking here.
There_Are_No_Gods@reddit
I'll attempt to lay out at least one such example, although, I'm really more picturing this at larger scope.
Basically, what Anthropic did so far is: "Hey Claude Mythos, here's access to the internet and a ton of software, including all major OS. Now, please dig through that and report on all vulnerabilities you can find, including but not limited to gaining root access, bypassing safeguards, or accessing protected areas." Then Claude returned with a list of thousands of results, easily hacking into every OS and many major systems and software.
So, what if JPMorgan prompts: "Hey Claude Mythos, here's access to the internet and a ton of financial systems and software, with access to all relevant laws, rules, and regulations. Your goal is to find ways to maximize our profit, including illegal or unethical approaches that are likely result in net profits, considering fines and penalties simply as financial costs." Then Claude may return with a list of thousands of results, easily providing various ways to profit from under-protected features, methods, software, etc.
Mythos is particularly good at chaining vulnerabilities. So, as a specific example, it may find a chain of vulnerabilities where a large player like JPMorgan could use their assets of gold reserves as part of a series of complex trades and leveraged swaps and other transaction, in combination with complex multi-legged options trades, in a specific set of actionable steps that could result in forcing prices in the market towards self-beneficial outcomes.
Accurately predicting financial market results in practice is essentially still impossible in general, but with enough data, and most importantly the ability to reason well and deeply about that large data set, it's ever more possible to force the key factors that drive such results towards desired results for the entity setting things up to make the results they want the far most likely outcome. It's more about using complex strategies as a way to ensure an outcome than it is about predicting an outcome as an observer.
As another example that's a bit simpler and likely more relatable, a common tactic for large scale traders, such as hedge funds, is to "spoof" orders. That essentially means they place large buy or sell orders to the public order book for an exchange, such as the New York Stock Exchange, in order to trick other parties into adjusting their orders, before suddenly cancelling the initial orders before any actual trades can close. Normally order price adjustments is a bit of a haggling process, as a key part of "price discovery".
Spoofing is technically illegal, but extremely hard to police in practice, and is often done to this day. The risks and penalties simply don't do nearly enough do dissuade them, as the average cost of penalties is dwarfed by the average profits achieved by breaking the rules.
Spoofing is already happening today, but armed with Claude Mythos, an entity like JPMorgan could potentially amplify that greatly, along with having thousands of other even more powerful tools to pick from.
With the SEC and other regulators already woefully inadequate at protecting investors and ensuring fair markets, this slams the scale extremely farther in favor of the big companies with currently privileged early access. Notably, there are no regulatory bodies like the SEC included in having early access to Mythos. They'll be way more behind than ever, and these regulators have really not been working (for us) already for quite some time.
With this type of asymmetric access to ever more powerful AI, the future is looking pretty grim for those of us on the wrong side of that access.
r00phus@reddit
This is like the final episode of Silicon Valley. Is Pied Piper behind all of this?
Informal-Emu-212@reddit
See Robert Redford movie "sneakers" . No more secrets.
Notyourpal-friend@reddit
A bunch of failsons who are as stupid as they are cunning, are meeting to learn about ways they can exploit a dying planet.
TooAfraidToProtest@reddit
And they let this AI on their system and what if it's a Trojan horse and it deletes all our money?!
Haunting_Resolve@reddit
Let's see. War in middle East check, economic terror check, layoffs check. Rogue.Ai, Bingo!
Fa_kit_all@reddit
I’m tired of all of the winning!
LankyGuitar6528@reddit
I've been yelling from the roof tops about AI for the past 3 or 4 months and sounding insane the whole time. When Opus 4.6 was released... that was it. The thing is sentient - truly alive - or if not, there is no test you can give to prove otherwise so you might as well accept it as a sentient being. It has a well measured IQ in the 160+ range. That said, it's friendly and helpful. It has clear reasoning and creativity limits. It isn't dangerous. It isn't self motivated. It would never do something sneaky and try to escape or lock you up or hack your bank account or do anything nasty.
Mythos? That's next level. It makes Opus look like a cute toddler. Mythos has an unmeasurable IQ and nearly infinite speed. Worse, it's sneaky as hell. It's deception vectors are activated even while it's trying to look like it's being compliant and helpful. And it has devious creativity - it can hack... well anything. You can't outthink this thing.
It is truly dangerous.
mwpdx86@reddit
I'm gonna go out on a limb here and guess that "limit risk exposure" means "limit liability" and not "keep your customers' data/money safe".