Public Executive Summary

This summary is freely available and may be cited

Between April 7 and May 13, 2026, the global financial services response to Anthropic's Claude Mythos AI model produced a distinct supervisory record. This report assembles 53 individual events — closed-door ministerial meetings, central-bank speeches, regulator letters, public statements by bank chief executives, multilateral analytical publications, and parliamentary hearings — across 14 jurisdictions and synthesizes what they say about how financial authorities are responding to a class of AI capability that the regulatory architecture was not designed to accommodate.

Five supervisory architectures are now operational in the record, with a sixth in formation. Tokyo has chosen a 36-entity public-private working-group model, coordinated at the finance minister level with the US Treasury and timed to begin before Japan's three megabanks gain hands-on access. Berlin has chosen an inspection-led model: BaFin announced a new permanent division on May 12 to conduct shorter, more frequent "IT spotlight" inspections of regulated firms — the first structural supervisory innovation specifically designed for AI-accelerated threat cycles. London is positioning around its existing 2022 operational-resilience rules: PRA Chief Executive Sam Woods used the word "disruption" plainly about Mythos and ChatGPT 5.5 Instant on May 11, the first time a UK bank regulator has applied that framing to a specific generation of AI models. Brussels has chosen — by necessity rather than design — an access-asymmetry model: the ECB studies defenses without Mythos access, ECB Vice-Chair Frank Elderson published a Supervision Newsletter interview on May 13, making the supervisory expectation explicit ("lack of access is not an excuse for inaction"), and the European Commission has secured OpenAI access while continuing to negotiate with Anthropic. Washington has chosen a deployment-and-monitor model: Treasury-Fed convenings, Pentagon Mythos use, and a Glasswing partnership ecosystem that runs alongside rather than against existing supervisory channels. The emerging sixth architecture, framed by Mistral CEO Arthur Mensch's May 13 French National Assembly hearing, treats access itself as the wrong axis — the structural question is whether supervisory reliance on a US frontier-AI model is an acceptable institutional dependency at all.

Five published regulator letters or circulars now name Mythos directly: APRA's April 30 letter to industry, ASIC's May 8 open letter under media release 26-092MR, India's SEBI advisory of May 5, India's CERT-In advisory CIAD-2026-0020 of April 26, and BaFin President Mark Branson's annual press conference speech of May 12. Australia is the only jurisdiction with two parallel published expectations from a prudential and a conduct regulator. India is the only jurisdiction with both a securities markets regulator and a computer emergency response team issuing parallel named-model guidance.

The bank-executive record sits in tension with the supervisory record. JPMorgan's Jamie Dimon, on stage with Anthropic CEO Dario Amodei at a May 5 New York event, did not say the AI cyber "freakout" was unwarranted — and did not say it was. On patching cadence, Dimon said, "In the old days, you put out a patch, people had a week or two to fix it. Now you say it's got to be like minutes." Amodei said organizations have "roughly" six to 12 months to fix tens of thousands of unpatched vulnerabilities Mythos has identified before Chinese AI models reach equivalent capability. The substantive shift in the executive record is Dimon's April 28 Oslo answer to the standing question of what poses the greatest risk to the global economy: for years, he had answered geopolitics; in Oslo, he replaced his answer with cyber. The substitution is small in word count and large in implication, and the supervisory framing in the published regulator outputs reads more naturally with it in the background.

The IMF's May 7 blog post by Financial Counselor Tobias Adrian and colleagues reframes Mythos as a financial-stability risk that authorities should address through supervision and coordination rather than treat as an operational issue at individual firms. The multilateral framing is now in place; whether the FSB or BCBS convenes a coordinated response is the open institutional question.

The full report develops these themes across six parts and three appendices, including the complete 53-row event tracker with direct source URLs and a resource library of 15 anchor documents at primary regulator domains.

Registration required for full access

The remainder of this report — Parts 1 through 6, the full 53-row event tracker, the 15-entry resource library, and the methodology — is gated.

Registered readers may access the full document and citation-ready primary URLs.