Much ado about Mythos

Banks have gotten a head start testing Mythos, the new cybersecurity model from Anthropic it deemed “too dangerous to release” to the public. What the lenders that have access are finding so far shows just how badly they needed it.

This is hardly the first time a new model has rocked the enterprise, but top regulators didn’t haul bank executives in the U.S. and Canada in for emergency meetings when GPT-5 got released last summer. The fear with Mythos is it can turn anyone into the best hacker banks have ever seen – not just because it can sniff out weaknesses in decades-old software that have evaded human detection, but because it can generate the code that lets them exploit it automatically.

Of course, as technologically advanced as Mythos may be, the non-release release – which doubled as marketing – played on humans’ basic instincts, too: We want what we can't have. “There are times when this feels like an arsonist selling fire extinguishers,” wrote J.P. Morgan Asset Management’s Michael Cembalest this week. 

Still, it’s showing there’s no shortage of fires to put out: One banker this week told us that tests of the model had already surfaced what would amount to a year’s worth of work updating systems and patching vulnerabilities. That’s the uglier part of what this model is exposing for banks: Even with all their AI transformation, they still can’t keep up with how fast AI is moving.

“The window between vulnerability discovery and exploitation has collapsed,” Santander’s AI research head, José Manuel de la Chica wrote this week. “What once took months now happens in minutes with AI.” 

Buck Rogers, former CISO of the Bank of England and ex-head of resilience risk for HSBC, said that speed-up is the real problem. “[Mythos] hasn’t actually changed the cyber risk at all. It’s just changed the tempo,” he told Evident in an interview this week. “Organizations aren’t built to keep up with that tempo.”

Banks have talked a big game about being ready for it: They’re “rewiring” every process, even full teams, around this tech. “I can’t find a CEO not talking about that,” Goldman Sachs CEO David Solomon said this week. But how flat-footed they are in how they can even respond to what Mythos surfaces shows just how far they still have to go.

Mythos – or OpenAI’s version or the rumored DeepSeek competitor – won’t be the last model to leap forward in an area banks care about. The same structures that slow down how a bank fixes vulnerabilities will also slow down how it captures AI’s upside. And that may prove just as consequential as the threats Mythos is revealing.

JPMorganChase, Morgan Stanley and Goldman Sachs are among the banks with access to Anthropic’s Mythos preview. Those banks also held their Q1 earnings calls this week, giving investors a chance to ask what they’ve seen firsthand. We broke down what they said – and what it actually meant.

“I’d say the banks, in total, are rather well protected. That doesn’t mean everything banks rely on is that well protected,” said JPMC’s Jamie Dimon.

• Decoded: It’s been almost a year since Pat Opet, the bank’s CISO, wrote an open letter telling third-party software and AI suppliers to stop prioritizing speed over security. Dimon is beating that drum again for good reason: Big banks are in the process of simplifying their systems. Until that happens, they’re going to need to spend time mapping which vendors are actually connected to what.

“Cyber resiliency is a top priority at institutions like ours across all of our businesses. If the ecosystem risk is likely increasing because of the quality and muscularity of the model, then we too need to get our gloves up and take it to another level….I want to say on the back end that a lot of the good that AI is going to bring, both as an efficiency and effectiveness matter, should not get dismissed,” said Ted Pick of Morgan Stanley.
 

• Decoded: AI is growing fast in banks’ tech budgets. Mythos will bring fresh questions about how banks are actually spending it. As cash gets diverted to patching vulnerabilities and playing defense, banks can’t let the offense – rolling out revenue-generating tools – suffer.

“We’re working closely with Anthropic and all of our security vendors to kind of harness frontier capabilities wherever it's possible. This will continue to be an important focus. It's not new that as technology evolves, we have to continue to upgrade for cyber risk and make sure we’re at the forefront of that,” said Goldman’s David Solomon.

• Decoded: All that we do with AI already is going to help us manage these risks, Solomon contends, leaning on his existing relationship with Anthropic to prove it (see: “Why Goldman went with Anthropic,” The Brief, Feb. 12). Expect the bank to continue to lean on the big labs to keep close to the frontier.

The size of the AI bill Visa racked up in March, the payments company reported, double what it had used in February. Token use – the meter that runs when people use AI tools – is becoming a metric firms flex to show their AI prowess. There’s some value to it: More token usage means either people are using AI more or what they’re asking AI to do is getting it to think harder and ping more resource-intensive tools, like reasoning models. But these numbers – and this “tokenmaxxing” trend where businesses try to one-up each other on token usage – should be taken with a very big grain of salt. Looking only at token totals is like measuring someone’s productivity based on how many emails they send. Sure, that could mean they’re doing a lot. It could also mean they’re sending memes to their colleagues.

Bigger picture: Banks need to be able to show they’re not using more AI, but using AI more effectively. Some banks – as we profiled last week – are coming up with new metrics, like “AI fluency” scores to get a better handle on that (See: “Flying (less) blind,” The Brief, April 9). “These models aren’t cheap, they take a lot of hardware to run,” Hari Gopalkrishnan, Bank of America’s chief technology and information officer, said at a conference this week. “It’s very easy to spend a lot of money and find out that you’ve got nothing in return.”

Goldman Sachs hired Archana Vemulapalli as its global head of AI product management and strategic relations, where she’ll “lead strategic engagement with frontier AI labs” and develop new AI tools. Vemulapalli was previously at AMD, where she was leading enterprise AI commercialization.

Mike Wynn, who leads Bank of America’s Academy for AI Capabilities and Enterprise Learning, is expanding his team from eight to 13 – including bringing Jason Roberts on to lead agentic AI strategy and deployment for the unit. The team focuses on “deploying AI capabilities that improve how our employees learn, work and support clients,” a bank spokesperson told Evident. One part of that work includes creating interactive simulations employees can use to improve client communication, something the bank discussed last year. Other banks following suit are showing this kind of AI-led training paying off: Singapore’s OCBC this week announced that wealth managers using its Gen AI training tool got double the client meetings and grew their revenue 50% more than the wealth managers that didn’t. 

Citi hired Jerry Lavish as global head of AI risk, approvals and portfolio oversight. Lavish is coming off of a one-year stint at Accenture, where he was the Americas responsible AI lead in financial services. Before that, he spent more than a decade at KPMG.

Tina Vo is now director of AI and data transformation for RBC Borealis. Vo was previously a director of strategy and transformation within the personal banking unit and has been with the firm since 2018.

Wells Fargo is hiring an Agentic AI safety and security lead for its enterprise AI platform.

Before JPMorganChase hired Manuela Veloso from Carnegie Mellon eight years ago to start an AI research team, a bank wasn’t an obvious home for an academic. Since then, every bank serious about AI has been trying to replicate the impact – and recruit the kind of talent – that Veloso’s team brought to JPMC.

Veloso stepped away from her post earlier this year, but not before building the biggest AI research team of any of the 50 banks we track. In that time, JPMC published nearly 40% of all the papers those banks published. Much of that research was translated into the biggest AI success stories inside the bank.

Now, the research model is shifting. Ownership of AI is moving out of central teams and into the lines of business. Banks are still hiring academics in droves, but the expectation of them is now less on publishing and more on building. We sat down with Veloso and asked her to reflect on how to make AI research successful inside a bank as this broader shift takes shape.

The following conversation is an excerpt from our full Q&A with Manuela Veloso; it’s been edited for length and clarity.

EVIDENT: For many years, you were doing and leading AI research within academia. Banking is, by nature, corporate. Those are very different worlds: How did you get them to mesh?

When I joined JPMorganChase to establish AI Research, I began as one person and in a few years I built a team of more than 100 experts on AI and related fields, all passionate about AI and the specific finance domain. Our mission was to move beyond off-the-shelf tools to explore novel solutions for business problems towards a culture to unlock the full potential of AI within the firm. Bridging the gap between research and deployment required business and engineering champions who enthusiastically embraced change – an approach that allowed the firm to achieve significant AI successes well ahead of the coming powerful scalable Gen AI. Ultimately, I believe that research in AI in particular is a vital, long-term investment for any successful business. 

Given the inevitable business focus on ROI, how do you see research, with its long-term exploration character, succeeding in a firm?

I can speak of my own experience and how we successfully proceeded. After a few months of acting as a listening and learning “sponge” to the business, we created seven pillars of research that were of business relevance, namely Learning from Experience, Data and Knowledge, Machine Vision and Language, Multi-Agent Systems, Recourse, Optimization, and Planning, Secure and Private AI, and Safe Human-AI Interaction. The AI research team was divided among such pillars and engaged with the related business leaders and their teams. Research solutions need to be rigorously tested, presented, and peer reviewed for their validity. Then we systematically and consistently presented such publications and solutions well adjusted to the business needs.

Read the full Q&A with Manuela Veloso, which covers the practical methods she used to get the most out of AI researchers and the biggest breakthrough she thinks is coming to banking.

Palo Alto Networks founder Nir Zuk is creating a new alternative to technology’s ever-raging build vs. buy debate – acquire. Zuk is buying California’s Liberty Bank and, if approved, intends to use it as a sandbox to build AI tools it will aim to sell to financial services companies. Zuk previously co-founded eOS, an agentic AI platform company that worked with Israel’s Esh Bank. COMING SOON: Evident is launching our inaugural Index covering banks in the Middle East and Africa. Get in touch to find out more about our first regional benchmark.

OpenAI is acquiring Hiro Finance, a personal finance startup that offers AI-powered financial planning tools. The startup last month launched a portfolio analysis tool that lets its users test financial moves to see expected returns side-by-side, founder Ethan Bloch wrote on LinkedIn. It’s another personal finance acquisition for Sam Altman’s lab, which last October bought Roi, another app that gave tailored insights about money to customers with AI. Banks aren’t just ceding personal finance turf though: Chatbots are getting agentic upgrades, which lenders hope will stave off the new competition (see: “Comeback kids,” The Brief, April 2).

Revolut is trying to build one model to rule them all. The bank this week debuted PRAGMA, a foundation model it built on “multi-source banking histories” that “can be reused” across many banking tasks, Pavel Nesterov, the firm’s executive director of data science and AI, wrote on LinkedIn. In the bank’s research paper, it showed how the model could power credit scoring, fraud detection, communication engagement and product recommendation tasks, which would cut how long it takes to scale tech into different parts of a bank significantly.

Lloyds is getting its board directors to use an AI tool called “board bot” – a tool from startup Board Intelligence – which helps them prepare for meetings by reviewing information and checking for bias in decision-making. It’s not the only board-related AI tool making waves this week: Jeff McMillan, former head of firmwide AI at Morgan Stanley, launched a new tool through his advisory firm that lets users ask AI versions of “twenty of history’s greatest minds” and McMillan himself how to solve problems. We asked how to make the newsletter you’re reading better, and an AI version of physicist Richard Feynman said to “rewrite it until it’s simple.” We can’t argue with that.