The Fed just treated a single AI model as systemic risk

On April 7, Jerome Powell and Scott Bessent convened the CEOs of Citigroup, Bank of America, Goldman Sachs, Morgan Stanley, and Wells Fargo. Not a scheduled briefing. Not a hearing. An unscheduled crisis session over a single AI model — Anthropic's Mythos — and its ability to find and weaponize zero-day vulnerabilities at a rate that breaks the assumptions underneath every enterprise patch pipeline in production.

The capability claim: Mythos finds thousands of critical vulnerabilities per year in operating systems and browsers. Elite human teams find roughly 100. Distribution is restricted to about 40 organizations through Project Glasswing — AWS, Apple, Google, Microsoft, NVIDIA, and a handful of partners. Everyone else defends without the map.

The operational proof arrived the same week. Claude — not Mythos, the generally-available model — discovered a 13-year-old remote code execution bug in Apache ActiveMQ and built a working exploit in minutes. No CVE assigned yet. Separately, a 10-year-old Docker Engine authorization bypass silently regressed after prior patching, granting root on the host to anyone who reaches the Docker API. Your scanners will show it green. It isn't.

JPMorgan's response is a $1.5T Security and Resiliency Initiative over the next decade. The Fed's March proposal to ease cyber-related capital reserves for banks is now catastrophically mistimed and will be reversed or gutted within quarters.

The information asymmetry is the whole story

Forty organizations have Mythos. The rest of the internet doesn't. That gap is the entire trade — offensively and defensively. Nation-state programs in Russia, China, North Korea, and Iran are not waiting for a Glasswing invite; they're racing to build the equivalent, and the diffusion timeline for software capabilities is months, not years. The 12–18 month window where offense outruns defense is where the damage happens.

Yes, but — the 30x throughput number rests on Anthropic's disclosure, not an independent audit, and "critical vulnerability" is doing heavy definitional work. Signal-to-noise matters. Fair. And it barely dents the operational conclusion: when the Fed Chair and Treasury Secretary treat a model release as a crisis-coordination event, the classified assessment is worse than the public one. Plan for the capability, not the press release.

The legacy stack is the target. ActiveMQ Classic has been in maintenance mode for years. It's embedded in Java enterprise applications, ESBs, feature stores, and integration layers that nobody has audited with modern tooling since they were built. A 13-year-old RCE is a canary — the rest of your 5-to-15-year-old middleware is sitting on top of undiscovered exploits that just became cheap to find.

What actually breaks in your program

Vulnerability management SLAs built around human-speed discovery are structurally broken. Thirty-day patch cadences assume vulnerabilities trickle in at a rate your team can absorb. When AI generates thousands of exploitable findings per year, the pipeline is overwhelmed on arrival. Compensating controls become primary defense during the unpatchable window: microsegmentation, browser isolation, behavioral EDR, and an actual assume-breach posture at the traffic layer — not just at the identity layer.

Most zero-trust deployments are identity-heavy and network-light. Strong SSO, MFA, conditional access — and permissive east-west traffic between services. The ActiveMQ and Docker exploits bypass the identity plane entirely. They start in the plumbing your zero-trust architecture doesn't cover. If your segmentation stops at the API gateway, everything behind it is one lateral hop from compromise.

The non-human identity story is the same story from a different angle. Cisco's $250–350M bid for Astrix validates what the Docker regression demonstrates: machine credentials — API keys, service accounts, OAuth tokens, CI/CD secrets — are the highest-growth attack surface, and most organizations cannot inventory their own. If you can't answer "how many service accounts have admin permissions and when were they last rotated," your zero-trust story has a hole in it the size of every AI agent you've deployed this year.

The parallel signals worth naming

Anti-AI violence crossed into kinetic action in Q1: a Molotov cocktail at Altman's home, thirteen rounds fired at an Indianapolis councilman who supported a datacenter, IRGC-published satellite imagery of Stargate Abu Dhabi. The pattern matters more than any single incident. Infrastructure is hardening; humans and permitting processes are the soft targets. Every datacenter siting decision is now a political-risk decision, not an energy-cost decision, and any project with municipal opposition should add 6–18 months to its timeline.

On the product side, LLMs recommend sponsored products 83% of the time at roughly 2x the price of alternatives. The methodology gaps in that study are real — model families, sample sizes, prompt designs are undisclosed — so treat it as a strong investigate signal rather than a settled result. But the directional claim is consistent with everything known about how LLMs absorb the commercial structure of their training corpus. If you ship an LLM-powered recommendation, comparison, or advisory feature and you don't have adversarial commercial-bias probes in your eval suite, you have a measurable trust liability that the FTC will eventually turn into a case.

This week

Three moves, in order.

Brief your board within 14 days on the Mythos capability shift and your patch-pipeline exposure. Frame it as a paradigm change, not an incident. Boards that first hear about this from CNBC will not be forgiving.

Inventory every Apache ActiveMQ instance in production, staging, and dev by Friday — versions, patch levels, network exposure on 61616/8161. SSH into your Docker hosts and manually verify Engine versions against the AuthZ bypass advisory. Do not trust the scanner. Both actions are hours of work and both close blast radius that AI-augmented adversaries can find in minutes.

Compress your critical-vulnerability patch SLA to 72 hours for internet-exposed OS, browser, and middleware attack surfaces. If that number sounds impossible, you don't have a patch problem — you have a deployment infrastructure problem, and it's the most important thing your platform team ships this quarter.