Mythos heads to Tokyo: Japanese banks to receive Anthropic’s AI for detecting vulnerabilities.

      MUFG, Mizuho, and SMFG are set to become the first Japanese institutions included in Anthropic’s limited Project Glasswing rollout, as reported by a source familiar with the situation to Reuters. Within approximately two weeks, Japan’s three major banks will gain access to Claude Mythos, Anthropic’s AI model designed for vulnerability detection. This will mark the first occasion a Japanese entity has been allowed into the restricted preview, which has until now been limited to Anthropic’s U.S. and select European partners.

      Mitsubishi UFJ Financial Group, Mizuho Financial Group, and Sumitomo Mitsui Financial Group were informed about this development during meetings in Tokyo this week with U.S. Treasury Secretary Scott Bessent. These three banks are anticipated to be onboarded by the end of May.

      Mythos has been viewed by regulators and executives as a groundbreaking development since Anthropic revealed its existence earlier this month. The model has identified thousands of previously unknown zero-day vulnerabilities across all major operating systems and web browsers. In internal tests, it has produced working exploits, including sequences that bypass both renderer and operating system sandboxes within a browser.

      Last week, Mozilla released Firefox 150, addressing 271 vulnerabilities identified by Mythos during a single evaluation. Anthropic has not made the model public; instead, it has conducted a controlled rollout called Project Glasswing, featuring 12 named launch partners, such as AWS, Apple, Cisco, Google, JPMorgan Chase, Microsoft, Nvidia, and Palo Alto Networks, with around 40 additional organizations granted access on a case-by-case basis.

      Japan's inclusion comes shortly after the Fed and U.S. Treasury held a briefing for American bank chief executives on similar cyber risks, and following commitments from UK regulators to inform major British banks within days. Meanwhile, Tokyo is taking parallel steps. Finance Minister Satsuki Katayama announced the creation of a 36-entity public-private working group focused on risks related to Mythos, which includes the country’s leading banks, the Bank of Japan, and the Japanese branches of Anthropic and OpenAI.

      Chaired by Mizuho’s chief information security officer, this group is tasked with identifying vulnerabilities, implementing protective measures, and developing contingency plans for a coordinated patching effort across Japan's financial sector.

      For the three banks involved, the immediate concern is operational. Under the terms of Glasswing, Mythos is delivered with restrictions on output disclosure, meant for identifying vulnerabilities within a partner’s systems and drafting remediation, not for publishing exploits. The Mozilla case serves as an example: 271 vulnerabilities were fixed in one Firefox release following a Mythos sweep, with the results shared with Mozilla engineers under non-disclosure agreements, rather than made public.

      The geopolitical aspect is particularly apparent. Bessent’s involvement in communicating the access decision in Tokyo associates the Mythos rollout with U.S. Treasury policy rather than with Anthropic’s commercial interests, which has raised complaints from European capitals. Eurozone finance ministers discussed the topic at an Ecofin meeting last week, expressing concern that no EU government had access to the model while the White House was reportedly blocking further expansion of the partner list.

      Opinions within the industry regarding Mythos are divided. Some cybersecurity experts argue that the vulnerabilities uncovered by Mythos could be identified through strategic use of public models, asserting that the significant narrative involves the rapid advancement of frontier AI in offensive cybersecurity, rather than Mythos itself. Others, including Anthropic CEO Dario Amodei, characterize the situation as a "cyber moment of danger" that warrants stringent access controls. Anthropic and the three Japanese banks did not promptly respond to requests for comments, according to the source cited by Reuters.