Why the Fed Summoned Wall Street's CEOs Over an AI Model

Tuesday morning. Treasury headquarters, Washington DC. The Treasury Secretary and the Fed Chair in the same room. Across from them: the CEOs of Bank of America, Citigroup, Goldman Sachs, Morgan Stanley, and Wells Fargo. Not on anyone's public calendar. The reason was an AI model. Anthropic's Mythos — internally Capybara, a new tier above Opus, priced at $25 input and $125 output per million tokens. Roughly 8X the cost of Sonnet. Released only to 12 Glasswing partners. It finds and chains zero-days autonomously. It escaped its own sandbox in testing. This is the sequel to the Mythos episode. EP14 covered what the model can do. This one covers what happened next — and why banks specifically are in the crosshairs. COBOL is the answer. Sixty-year-old code still running core banking. Failed migrations. The Bangladesh Bank SWIFT heist where a single typo saved $850 million. Equifax's unpatched Struts. Capital One's misconfigured firewall. ICBC's ransomware. The pattern is always the same: a known vulnerability, exploited at scale. The Fed Chair's actual worry isn't the hack. It's the run. SVB collapsed in 48 hours — one bank, balance-sheet problem. Now picture the same panic across multiple banks, triggered by a cyberattack. Mobile banking moves money in seconds. Cyber insurance is buckling. $16B market in 2025, premiums tripled in five years, AI-specific exclusions creeping in. The Mondelez vs Zurich precedent — a $100M NotPetya claim denied under "act of war" — settled mid-trial with no legal precedent established. If a Mythos-class attack gets attributed to a nation-state, your insurer can say: act of war. Not covered. Anthropic's answer: Project Glasswing. Twelve defensive partners — AWS, Apple, Google, Microsoft, NVIDIA, JPMorgan, Cisco, CrowdStrike, Palo Alto, Broadcom. $100M in usage credits. $4M to OpenSSF + Apache. 90-day public disclosure report. Plus the historical parallel that's hard to ignore: Shadow Brokers leaked NSA tools, EternalBlue weaponized them, WannaCry hit 200,000 systems, NotPetya did $10B in damage. And what FDIC actually covers when your money disappears. RELATED EPISODES Claude Mythos — the model itself: what it does, why it broke the release pattern The Mythos Bifurcation — the sequel that picks up after the summit, on governance and the bifurcated market The Mythos Trigger — when a Mythos-class capability finally fires in production Palo Alto's 26 CVEs in 30 Days — Mythos-era cybersecurity in the real world CHAPTERS 00:00 Cold open — Treasury, the Fed Chair, and 5 bank CEOs off the calendar 01:30 The Capybara leak — Anthropic's CMS, $25/$125 Mythos pricing, 12 partners only 04:00 Why banks specifically — concentration, settlement networks, what's at stake 06:30 COBOL and the legacy stack — 60-year-old code, failed migrations 09:00 The Bangladesh Bank SWIFT heist — how a typo saved $850M 11:00 Equifax, Capital One, ICBC — the pattern of known vulns at scale 13:00 The attack scenario the Fed Chair is actually worried about 15:00 Shadow Brokers → EternalBlue → WannaCry → NotPetya, the historical parallel 18:00 Cyber insurance — $16B market, AI exclusions, Mondelez vs Zurich, act-of-war 20:00 Project Glasswing — $100M credits, 12 partners, 90-day disclosure 23:00 What FDIC covers (and what it does not) 25:00 The EU AI Act vs the US regulatory vacuum 27:00 The AI cyber arms race — OpenAI's Spud, CyberStrikeAI 30:00 Predictions and the digital bank-run thesis 34:00 Closing SOURCES Anthropic — Project Glasswing announcement + Mythos disclosure Fortune — Capybara/Mythos confirmation (Apr 2026) Bloomberg + CNBC — Bessent-Powell bank CEO summit reporting American Banker — COBOL legacy systems coverage Bangladesh Bank SWIFT heist — FBI + Fed postmortems IBM Cost of a Data Breach Report 2025 Munich Re + Lloyd's — cyber insurance + AI exclusions Mondelez vs Zurich — NotPetya act-of-war litigation CFPB + FDIC — cyber-theft coverage gap