Why Australia’s banks are still waiting for Anthropic’s Mythos

Australia’s lethal new co pilot

Confusion now sits at the centre of the Mythos story in Australia. Anthropic has cracked the door open on its most powerful model, yet the institutions that arguably need it most are still standing in the hallway, waiting for their invite. One day after filing for a blockbuster US listing, the company extended access to Claude Mythos to 150 organisations globally, including a handful in Australia, but none of the big four banks or marquee infrastructure players will confirm they are in the club.

Anthropic’s pitch is seductively simple. Mythos is a frontier‑class AI built to read, reason about and write code at a level that lets it autonomously discover and chain together software vulnerabilities. In internal and partner testing it has reportedly surfaced thousands of flaws across every major operating system and browser, including decades‑old bugs in components that sit under core banking and payments infrastructure. For boards still haunted by Optus, Medibank and Latitude, the idea of an automated red team that can see what human auditors missed is intoxicating.

Yet corporate Australia is largely in the dark. Capital Brief has confirmed that none of the big four banks, the national grid operator Transgrid, Macquarie Technology Group, Medibank or InfoTrack have been granted direct access, even as Anthropic insists that “priority targets” for cyber attacks are at the front of the queue. Australian banks are being told they will benefit indirectly because cloud giants like Microsoft and Amazon Web Services are already using Mythos to harden their platforms, but that is cold comfort for institutions that want to run the tool against their own bespoke systems.

Analysts and policymakers are spooked, and not only because of who is waiting outside the velvet rope. The Reserve Bank, ASIC and APRA have all publicly acknowledged that Mythos‑class systems could expose financial‑system vulnerabilities at a speed and scale that destabilises payments and erodes confidence if exploited. ASIC has gone as far as to order licensees to put Mythos on the board agenda, warning that “the clock is at a minute to midnight” on cyber resilience. Former cyber officials like Alastair MacGibbon and private sector experts such as Dimitri Vedeneev describe a threat surface that is now changing on a three‑to‑six‑week cycle, outpacing traditional regulation and risk management.

What mythos is and why it matters is brutally simple. Claude Mythos Preview is an unreleased, restricted Anthropic model that behaves like a tireless, highly skilled hacker in a box: it can interrogate sprawling codebases, identify obscure bugs that have survived decades of patching and then write working exploit code without human guidance. That makes it a potentially transformative defensive tool for banks and critical infrastructure, but also a blueprint for how frontier AI could be weaponised against those same institutions if it leaks or is replicated.

This is why analysts and policymakers are so rattled. A capability that can quietly turn long‑trusted legacy systems into fresh attack surfaces is not just another security product, it is a systemic risk. As long as Australia’s major banks and corporates are left queuing for access, they are being asked to manage that risk in the dark, relying on promises and second‑hand protections in a game that has abruptly moved to a higher league.

Get the stories that matter to you.
Subscribe to Cyber News Centre and update your preferences to follow our Daily 4min Cyber Update, Innovative AI Startups, The AI Diplomat series, or the main Cyber News Centre newsletter — featuring in-depth analysis on major cyber incidents, tech breakthroughs, global policy, and AI developments.