Global Banks: Mythos-class era: Cybersecurity a bigger concern than credit risk

Research evidence excerpt

Global Banks: Mythos-class era: Cybersecurity a bigger concern than credit risk

Kian Abouhossein AC Europe Equity Research

(44-20) 7134-4575 29 June 2026 J P M O R G A N

kian.abouhossein@jpmorgan.com

highlighting vulnerabilities.

Anthropic’s Claude Mythos Preview (Mythos, released in April 2026) under controlled

evaluation by various authorised agencies (such as AI Security Institute in the UK) has been

reported to demonstrate significantly more advanced AI cyber capabilities than any other

models. These evaluations have demonstrated that Mythos could autonomously discover and

exploit vulnerabilities on exposed networks, executing multi-stage attacks, work that would

typically take human professionals days to complete. Mythos is just one example of future

AI capabilities, with other models such as GPT-5.5 also demonstrating similar levels of

performance (see Figure 1StepupincyberperformanceoverpreviousfrontiermodelswithMythosandGPT-5.5) on cyber evaluations by agencies, and we would expect more

sophisticated models to be developed over time, meaning banks and regulators would need

to be dynamic in their approach to dealing with the evolving cybersecurity landscape. While

projects like Glasswing also demonstrate the power of collaboration between firms and

authorities to use these models to strengthen cyber defences, with restrictions on general

availability of these models, we believe the speed at which vulnerabilities are discovered is

increasing and the reaction time between the identification of vulnerabilities and their

patching is getting compressed, which should continue to pose a challenge.

With an increase in cybersecurity related incidents, we believe cyber insurance will

become increasingly relevant for banks to avoid situations like Jaguar Land Rover (JLR)