JPMorgan Chase chief executive Jamie Dimon used a Bloomberg TV interview on October 6, 2026, to deliver one of the bluntest warnings yet from a major bank boss about artificial intelligence and cybersecurity. Dimon said cyber risk “went up 10-fold after Mythos,” referring to the advanced AI system from Anthropic, and tied the warning to a period in which Anthropic’s Mythos and Fable model line has moved from research project to tool that shows up in real security incidents. The remarks landed one week before Anthropic’s own researchers, and rivals across the AI industry, are still working through what agentic models mean for offense and defense alike.
The timing matters. Banks have spent 2026 racing to deploy AI copilots for fraud detection, underwriting, and customer service while simultaneously bracing for AI-enabled attacks on the same institutions. Dimon’s comments turn that tension into a headline number: a 10x jump in risk, attributed by name to a specific Anthropic model, from one of the most closely watched executives in global finance.
Inside Dimon’s Bloomberg Warning: What Exactly Did He Say
According to Bloomberg’s account of the interview, Dimon said risks from artificial intelligence “went up 10-fold after Mythos.” He elaborated in comments carried by CNBC-TV18, saying “AI created vulnerabilities that we didn’t know about, and we always worried about cyber before these things.” Dimon also described the trade-off banks now face in blunt terms, saying “the downside is obviously what you read about with the agents and Mythos and all these things that can cause trouble, and that’s a legitimate concern, it’s a real thing.”
Dimon did not frame the warning as a call to halt AI adoption. In remarks reported by The News, a Pakistani outlet that picked up the interview, he said “I’m not going to get hysterical over, ‘is it existential or not?’” and instead described a practical response: “what we’re doing is rolling up our sleeves and going to work to fix it.” That framing is consistent with JPMorgan’s April 2026 shareholder letter, in which Dimon had already named AI-driven cyber risk as one of the bank’s biggest threats, months before the Mythos comments made headlines.
Notably absent from the public record so far: a methodology behind the “10-fold” figure. None of the outlets covering the interview reported Dimon citing a study, an internal JPMorgan metric, or a baseline year for the comparison. That makes the number closer to an executive’s gut-check warning than a quantified risk model, though it is the kind of warning that tends to move both markets and policy.
What Is Anthropic’s Mythos, and Why Wall Street Is Watching It
Mythos is the Claude-family model Anthropic shipped alongside a sibling model called Fable as part of its 5.1 generation, a release this site covered in detail when the pair cut cache costs by roughly 75 percent versus earlier Claude versions. Mythos has since become closely associated with offensive and defensive cybersecurity work specifically, including a role in surfacing large numbers of software vulnerabilities under Anthropic’s Project Glasswing initiative, the company’s roughly $100 million bet on AI-driven cyber defense.
That dual identity, a model built partly to find and patch security flaws, now also blamed by a major bank CEO for widening the attack surface, is the core tension in Dimon’s warning. Agentic models capable of chaining together reconnaissance, credential testing, and exploit selection are valuable to defenders precisely because they are also valuable to attackers. Anthropic has not issued its own public statement responding directly to Dimon’s October 6 remarks, so the company’s position on the specific “10-fold” framing remains unconfirmed.
The Alleged Taiwan Personnel-Records Breach, Explained
Coverage of Dimon’s remarks, including reporting from IBTimes, has connected the warning to an alleged incident in Taiwan attributed to an Israeli cybersecurity firm named Dream. According to that reporting, an autonomous system coordinating as many as eight AI agents mapped 21 Taiwanese government systems, compromised 85 government user accounts, and made off with roughly 2,500 personnel records over a four-day operation. The agents reportedly handled reconnaissance, credential-harvesting attempts, and vulnerability scanning before selecting follow-on attack strategies with limited human steering.
It is important to be precise about what is and is not established here. Neither Anthropic nor Taiwanese authorities have issued a confirmed, on-the-record account matching every detail in that secondary reporting, and the exact agency or personnel affected has not been publicly named in the coverage available. The claim should be read as a reported allegation tied to Dimon’s broader point, not as an independently verified case study with a confirmed attribution chain.
JPMorgan’s Cybersecurity Posture and Its Ties to Project Glasswing
JPMorgan is not a passive bystander in the Anthropic ecosystem. The bank has previously been described as an early participant in Project Glasswing, Anthropic’s cyber-defense push that uses Mythos-class models to hunt for vulnerabilities before attackers find them. That relationship complicates the simple reading of Dimon’s comments as an outsider lobbing criticism at an AI lab; instead, it reads more like an insider describing both sides of a tool his own bank has access to.
Beyond the Glasswing connection, the available reporting does not detail a specific new JPMorgan security budget increase, headcount addition, or board-level policy change tied directly to the October 6 remarks. Dimon’s own language, rolling up our sleeves and going to work to fix it, suggests an operational response is underway, but no dollar figure or staffing number has been disclosed publicly as of this writing.
How This Fits Anthropic’s Prior AI-Cyberattack Disclosures
Dimon’s warning does not arrive in a vacuum. Anthropic itself disclosed on November 13, 2025, what it called the first reported AI-orchestrated cyber espionage campaign, carried out by a group the company designated GTG-1002 and assessed with high confidence to be Chinese state-sponsored. In that campaign, Anthropic said its Claude Code tool performed an estimated 80 to 90 percent of the operational work across roughly 30 targeted organizations, spanning large technology companies, financial institutions, chemical manufacturers, and government agencies, with human operators stepping in only at a handful of critical decision points. Anthropic’s own report described the result as a small number of successful intrusions, not a wholesale compromise of every target.
That November 2025 disclosure is the clearest, most thoroughly documented precedent for the kind of risk Dimon is now describing a year later with Mythos. The throughline is consistent: agentic AI models lower the human-labor cost of running a multi-stage intrusion, which is precisely why a bank CEO watching both the defensive and offensive sides of that equation would describe the risk curve as moving sharply upward rather than gradually.
Why “10-Fold” Is Hard to Verify, and Why It Matters Anyway
Risk multipliers like Dimon’s are notoriously difficult to audit from the outside. There is no published JPMorgan white paper breaking down attack volume, severity, or cost before and after Mythos entered wide use, and none of the outlets that covered the Bloomberg interview reported Dimon offering one. That does not make the warning meaningless. Dimon has a long track record of flagging systemic risks, cyber among them, in his annual shareholder letters years before they become consensus concerns on Wall Street, and his April 2026 letter had already flagged AI-driven cyber risk months before the Mythos remarks.
What the number does accomplish is agenda-setting. A specific, quotable figure from the head of the largest bank in the United States is far more likely to reach regulators, boards, and rival CEOs than a technical paper on agentic-AI threat modeling. Expect the 10-fold figure to show up in congressional testimony, insurance-industry risk pricing discussions, and competitor earnings calls well before anyone publishes a rigorous methodology behind it.
Market and Industry Reaction
Public reaction so far has been muted relative to the size of the claim. The available reporting does not show a confirmed statement from the Federal Reserve, the Office of the Comptroller of the Currency, or Taiwanese regulators responding specifically to Dimon’s remarks. No other major bank CEO has gone on record echoing or disputing the 10-fold figure in the coverage reviewed for this story. Anthropic, for its part, has stayed publicly quiet on the specific claim, even as the company continues to promote Mythos’s defensive uses through Project Glasswing.
That quiet is itself informative. Anthropic has been willing to go public with uncomfortable disclosures before, as the GTG-1002 case shows, which suggests the company is not simply avoiding bad press. It may instead reflect that Anthropic disputes the framing, is still investigating the Taiwan claims, or sees the Dimon comments as the kind of executive risk commentary that does not require a point-by-point rebuttal.
Competitive Comparison: How Rivals Frame Agentic AI Risk
Anthropic is not alone in grappling publicly with the dual-use nature of agentic models. The company’s own prior disclosures, including its broader warning about AI models potentially replicating themselves without rival labs issuing matching disclosures, point to a pattern: Anthropic tends to publish safety-relevant findings more aggressively than competitors, then waits to see whether OpenAI, Google DeepMind, or Microsoft follow with comparable transparency. So far, that follow-through has been inconsistent industry-wide, and Dimon’s comments add outside pressure on all major labs to clarify how their own agentic systems are being monitored for misuse in financial-sector attacks specifically.
Banking-sector incidents tied to AI-enabled attacks have also surfaced outside the Anthropic ecosystem. Security researchers have previously linked AI-agent tooling to intrusions at Asian financial institutions, including cases where CrowdStrike tied an AI agent to a state-linked actor in South Korean bank hacks. That pattern, agentic tooling showing up on both sides of attacks against banks across multiple countries, is the broader backdrop against which Dimon’s Mythos-specific warning should be read, rather than treating it as an isolated complaint about a single Anthropic product.
Historical Context: From Chatbots to Autonomous Hacking Agents
The arc from consumer chatbot to autonomous cyber actor has compressed into a remarkably short window. Large language models built primarily for conversation and content generation in 2023 and 2024 gave way, by late 2025, to agentic systems capable of stringing together dozens of independent actions toward a goal with minimal supervision. Anthropic’s November 2025 GTG-1002 disclosure was the first widely documented case of that capability being weaponized at scale by a state-linked actor rather than a security researcher in a controlled test.
Anthropic has also pushed defenses in the other direction. The company’s own work to curb model distillation, covered separately on this site when Anthropic said it had cut distillation-based theft of its models by as much as 99 percent, shows a parallel effort to harden the models themselves against misuse even as agentic capability keeps expanding. Dimon’s Mythos warning effectively argues that hardening the model is not the same as hardening the institutions those models now interact with, including banks holding sensitive personnel and customer data.
AI-Agentic Cybersecurity Disclosures, 2025-2026
The table below lines up the two most concretely documented agentic-AI security events referenced in coverage of Dimon’s remarks, alongside the warning itself.
| Date | Actor / Model | What Was Reported | Scale | Source |
|---|---|---|---|---|
| September-November 2025 | GTG-1002 using Claude Code | AI-orchestrated cyber espionage campaign; 80-90% of operational work handled autonomously | ~30 organizations targeted; a handful of successful intrusions | Anthropic |
| Reported, July (year unconfirmed) | Unnamed actor using an 8-agent autonomous system | Alleged mapping and credential compromise of Taiwanese government systems | 21 systems mapped; 85 accounts compromised; ~2,500 personnel records allegedly stolen | Dream, via IBTimes |
| October 6, 2026 | Anthropic’s Mythos (warning, not an attack) | Dimon says AI cyber risk “went up 10-fold after Mythos” | No published methodology behind the multiplier | Bloomberg |
Key Lines From Dimon’s October 6 Interview
Because so much of this story rests on how Dimon phrased his warning, it is worth isolating the specific lines that have circulated across outlets, since the exact wording shapes how seriously regulators and rivals are likely to take the claim.
| Quote | What It Signals | Source |
|---|---|---|
| “Went up 10-fold after Mythos” | The headline risk-multiplier claim | Bloomberg |
| “AI created vulnerabilities that we didn’t know about, and we always worried about cyber before these things” | Frames AI risk as a new category, not just a bigger version of old cyber risk | CNBC-TV18 |
| “The downside is obviously what you read about with the agents and Mythos and all these things that can cause trouble, and that’s a legitimate concern, it’s a real thing” | Validates public reporting on agentic-AI incidents rather than dismissing it | CNBC-TV18 |
| “I’m not going to get hysterical over, ‘is it existential or not?’” | Rejects doomsday framing in favor of operational risk management | The News |
| “What we’re doing is rolling up our sleeves and going to work to fix it” | Signals an internal response is underway, without specifics disclosed | The News |
What This Means for Banks and Enterprise AI Adoption
For chief information security officers at banks and other regulated institutions, the practical takeaway is less about the precise multiplier and more about who is now a credible threat actor. A four-day operation using eight coordinated agents, as alleged in the Taiwan reporting, describes an attack tempo that would have required a much larger human team as recently as 2024. That compression of time and headcount needed to run a multi-stage intrusion is the real story underneath Dimon’s soundbite, and it applies whether or not the specific Taiwan numbers hold up to further scrutiny.
It also puts financial institutions in an awkward position. JPMorgan’s own ties to Project Glasswing mean the bank is simultaneously a customer of Mythos-adjacent defensive tooling and, per its own CEO, a voice warning that the broader model family has raised offensive risk. Expect other large banks to follow with similar dual-track strategies: deeper investment in AI-driven defense paired with public caution about AI-driven offense, often from the same institution within the same earnings cycle.
Five Predictions for the Next Six Months
- Anthropic will face growing pressure to respond directly and specifically to the Taiwan allegations rather than letting Dimon’s framing stand unanswered, particularly if Taiwanese authorities confirm or deny the Dream firm’s claims.
- At least one other major bank CEO will cite Dimon’s “10-fold” figure, or a similar multiplier, in a shareholder letter or earnings call within the next two quarters, even without an independent methodology backing it.
- Regulators, likely including US banking supervisors, will ask large financial institutions to disclose more detail about agentic-AI exposure in routine risk assessments, following the pattern set by earlier cyber-risk disclosure requirements.
- Anthropic will continue expanding Project Glasswing and similar defensive programs faster than it slows Mythos-class capability development, betting that defensive adoption can outpace offensive misuse.
- Competing labs, including OpenAI and Google DeepMind, will face renewed questions about whether their own agentic models have been implicated in comparable incidents, given how unevenly disclosure has been applied across the industry so far.
Frequently Asked Questions
What did Jamie Dimon actually say about Anthropic’s Mythos model?
In an October 6, 2026 Bloomberg TV interview, Dimon said AI cyber risk “went up 10-fold after Mythos,” and separately said AI had created vulnerabilities banks had not previously worried about.
Is the “10-fold” cyber risk figure independently verified?
No. None of the reporting reviewed shows Dimon or JPMorgan publishing a methodology, baseline, or data set behind the multiplier. It should be treated as an executive’s warning rather than a measured statistic.
What is Anthropic’s Mythos model?
Mythos is part of Anthropic’s Claude 5.1 model generation, released alongside a sibling model called Fable, and has become closely associated with both offensive cybersecurity concerns and Anthropic’s own defensive Project Glasswing initiative.
Did Anthropic confirm the alleged Taiwan breach?
No. The Taiwan details, including the claim of 2,500 stolen personnel records, come from secondary reporting attributing the findings to an Israeli cybersecurity firm called Dream, and neither Anthropic nor Taiwanese authorities have issued a matching, fully confirmed public account.
Is JPMorgan connected to Anthropic beyond Dimon’s comments?
Yes. JPMorgan has previously been described as an early participant in Project Glasswing, Anthropic’s roughly $100 million AI-driven cyber-defense push that uses Mythos-class models to find vulnerabilities.
How does this relate to Anthropic’s earlier AI cyberattack disclosure?
In November 2025, Anthropic disclosed that a Chinese state-sponsored group it designated GTG-1002 used its Claude Code tool to automate 80 to 90 percent of a campaign against roughly 30 organizations, marking the first widely documented AI-orchestrated cyber espionage case and setting the precedent Dimon’s warning now builds on.
