Anthropic PBC 的 Mythos 在被描述为「太危险而不宜公开」后，却立即成为监管与金融圈高度关注的议题。US Treasury Secretary Scott Bessent 在 Anthropic 公布新技术后，召集 Wall Street 领导层确认防护措施，并引发外界对谁能先行接触这项技术的讨论。随后，美国财政部主动推动取得 Mythos 存取权；另一方面，UK 的 AI Security Institute 已先行获得该模型并完成评估。该机构认为 Mythos 在部分攻击场景下对复杂网路攻击的支援能力，超过 OpenAI 的 ChatGPT 及 Google 的 Gemini。

该评估指出，Mythos 对「防护薄弱」或简化系统的风险最大，而非以往所想像的传统巨型金融机构。大银行虽防线较高，但仍需面对新风险；以 Barclays Plc 与 Wells Fargo & Co. 为例，其 IT 团队通常仍依循 responsible disclosure 流程：接收厂商漏洞公告、测试补丁、管理层签核，再分批上线修补，常耗时数周到数月。传统上，这种做法足以让黑客的攻击链形成较慢，因为漏洞研究与利用测试需要时间。

关键趋势是速度被颠覆：hackers can now turn disclosure data into live attack scripts. 根据 zerodayclock.com，从漏洞公开到可用攻击的平均时间，已由2018年的 771 天（约18,504 小时）缩短到目前不到 4 小时，速度提升约 4,600 倍。生成式 AI 更进一步赋予了 agentic 行为，Anthropic 的 Claude Cowork（2026 年 1 月版本）可自动重复尝试、寄送邮件与安排日程，并串接多步骤攻击路径，等同自动化的「开窗—钥匙开门—关闭警报」流程。这使 responsible disclosure 与缓慢补丁机制在中小企业、医疗与一般商店等防御资源不足的对象中，暴露出结构性弱点。

Anthropic PBC's Mythos, described as too dangerous to release, quickly became a governance and banking issue after announcement of the model. US Treasury Secretary Scott Bessent summoned Wall Street leadership and pressed banks to validate system protections, while questions spread over who would gain early access. The U.S. Treasury then moved to seek official access. Meanwhile, the UK AI Security Institute had already obtained the model and assessed it, concluding that Mythos appears more capable for certain cyber abuse than OpenAI's ChatGPT and Google's Gemini.

The Institute said Mythos is most dangerous against weakly defended or simplified systems, not automatically the best-protected global banks. Large banks still operate under a responsible disclosure workflow: software vendors announce vulnerabilities and suggested patches, IT teams at firms such as Barclays Plc and Wells Fargo & Co. test patches, get management sign-off, and deploy over weeks or months. That cadence once made sense because converting a disclosed bug into an exploitable chain required substantial time for actors to inspect the flaw and experiment.

Generative AI now compresses that cycle sharply. After disclosure, hackers can immediately feed details to chatbots that scan public repositories like GitHub for similar weak patterns and generate exploit routes. New agentic capabilities, such as Anthropic's Claude Cowork (released in January), automate repeated attempts and multi-step chaining, making end-to-end intrusion planning faster. According to zerodayclock.com, the average gap between disclosure and a working attack has dropped from 771 days (about 18,504 hours) to under 4 hours, roughly 4,600 times faster. As a result, traditional responsible disclosure and weeks-to-months patching look increasingly misaligned, especially for small and medium enterprises, hospitals, and smaller firms that lack security staffing and capital.