Claude Mythos Could Expose GCC Banking Infrastructure to Unprecedented AI-Driven Cyber Risk

When Anthropic announced Claude Mythos Preview on April 7, the cybersecurity community's immediate concern was not theoretical. It was operational — and for the banking sector, it is becoming urgent.

A Reuters investigation, drawing on interviews with cybersecurity executives, former regulators, and financial institutions, outlines why Mythos represents a particularly acute threat to banks and financial services firms: legacy technology stacks, deep IT interconnections, and a narrow shared vendor ecosystem that could turn any AI-powered exploit into a systemic event.

Why Banking Infrastructure Is Especially Exposed

Modern banks do not run on modern software alone. Beneath layers of digital banking interfaces and cloud-native applications sit decades-old systems — IBM mainframes, legacy core banking platforms, and software libraries that have been patched and updated repeatedly but never fully replaced. It is precisely this complexity that makes financial institutions a high-value target for an AI model capable of autonomous vulnerability discovery.

"A model like Mythos would have a field day finding exploits" in certain legacy banking systems, said Costin Raiu, co-founder of cybersecurity firm TLPBLACK and a longtime security researcher, pointing to IBM-related infrastructure as a specific example of technologies still powering the financial industry.

TJ Marlin, CEO of enterprise AI security firm Guardrail Technologies, put the risk in starker terms. Mythos Preview can "look across a very complex architecture, including this legacy infrastructure where, frankly, these undiscovered vulnerabilities and complexities are now accessible and threat factors." When those vulnerabilities are exploited at scale, he warned, the consequences could be "potentially catastrophic."

The Interconnection Problem

The risk is compounded by the structure of the banking industry itself. Financial institutions — particularly in heavily regulated markets like the UAE and Saudi Arabia — operate within tightly interconnected ecosystems, sharing vendors, KYC platforms, transaction processing infrastructure, and compliance tooling across institutions.

"Because it's a very specialized industry and heavily regulated, there's a lot of IT interconnections," said Naresh Raheja, a consultant and former official at the US Office of the Comptroller of the Currency. "Many banks use the same vendors and the same solutions."

For GCC financial institutions, this interconnection dynamic is amplified. The region's banking sector has undergone rapid digital transformation under Vision 2030 and UAE national digitisation agendas — integrating modern cloud platforms with legacy core systems in ways that may have introduced exactly the kind of complex, layered architecture that Mythos is designed to analyse autonomously.

What Mythos Can Actually Do

Anthropic's own technical documentation describes how Mythos Preview identified thousands of high and critical-severity vulnerabilities across major operating systems and web browsers — including a 16-year-old vulnerability in the widely used FFmpeg software library and a flaw in a virtual machine monitor system designed to provide hardware-level isolation.

The model does not just find vulnerabilities. It devises exploit paths autonomously, chaining multiple weaknesses into single attack sequences without human guidance. In internal testing, Mythos generated 181 working exploits against Firefox vulnerabilities where the previous best AI model succeeded only twice under identical conditions.

Anthropic has confirmed that Claude Mythos Preview will not be made generally available. Instead, the company launched Project Glasswing, a private evaluation programme involving major technology companies, cybersecurity vendors, and financial institutions including JPMorgan Chase — giving selected organisations early access to assess the model and develop defensive countermeasures.

JPMorgan described its participation as a unique opportunity to evaluate next-generation AI tools for defensive cybersecurity across critical infrastructure.

Government Response and Regulatory Signals

The threat has already reached the highest levels of government. Officials in the United States, Canada, and the United Kingdom have held meetings with senior banking executives to discuss the specific risks posed by Claude Mythos Preview. The US Treasury confirmed that the administration is pushing financial institutions to understand and anticipate a wide range of market developments related to the model, with further meetings planned.

For GCC financial regulators — including the Saudi Central Bank (SAMA), the UAE Central Bank, and financial supervisory bodies in Qatar and Kuwait — this international regulatory mobilisation represents a clear signal. The AI-driven vulnerability threat is no longer a future scenario. It is an active operational risk being addressed at government level in major financial jurisdictions.

The Cloud Security Alliance, in its April 12 strategy briefing co-authored by SANS Institute and OWASP, described Mythos as representing a step change in capable AI models that lowers the cost and skill floor for discovering and exploiting vulnerabilities faster than organisations can patch them. That briefing is available free at labs.cloudsecurityalliance.org/mythos-ciso.

What GCC Financial Security Leaders Should Do Now

For CISOs and security leads at GCC banks and financial institutions, the Reuters reporting crystallises three immediate priorities: conducting AI-assisted vulnerability assessments of legacy infrastructure before threat actors do; reviewing shared vendor and platform dependencies for systemic exposure; and engaging directly with the Project Glasswing framework or equivalent defensive AI evaluation programmes.

IBM has publicly called for a more open-source approach to Mythos — arguing that broader access to the model by companies and researchers would accelerate defensive preparation across the industry. The window for proactive preparation is narrow. As the mean time from vulnerability disclosure to confirmed exploitation has already fallen to under one day in 2026, banking infrastructure running legacy systems measured in decades demands immediate attention.