Dimon puts a tenfold multiplier on AI cyber risk since Anthropic's Mythos

Dimon gave Bloomberg TV a multiple without a base ^[1]. The rest of his answer put that base well above zero. "AI created vulnerabilities that we didn't know about, and we always worried about cyber before these things," he said ^[2].

He described the response as labor. "I'm not going to get hysterical over, 'Is it existential or not?' What we're doing is rolling up our sleeves and going to work to fix it," he said ^[5]. Neither report puts a dollar figure on that work, so the unit available is people. The Tuesday, Oct. 6 interview ^[6] came five to six months after JPMorgan got Mythos access ^[14]. Take the "hundreds" of full-time staff Dimon cited in April ^[7] at the low end, 200, and assume the staffing held. That is 1,000 person-months over five months, or about 83 person-years ^[15].

Access is the more interesting term. Dimon has compared broad access to Mythos to giving ballistic missiles to individuals, citing a vulnerability-finding ability that Anthropic has said is too dangerous for general release ^[8]. His bank is one of the few firms with narrow access ^[7]. The public Claude Fable 5 runs on the same architecture as Mythos 5 but carries classifiers that intercept outputs in cybersecurity, biology and chemistry ^[9]. A lender outside the Glasswing list ^[10] therefore tests its systems with a model that intercepts cybersecurity output. The vetted group can get that output from Mythos 5, with some safeguards lifted ^[10].

One outcome is that Dimon's multiple becomes a cyber budget line at banks generally. Another is that the spending pools among vetted institutions that can test against the less restricted model. A third is that the White House task force ^[11] changes who gets access. I think the second fits the evidence today, because the only quantified response on record comes from a bank that had the model before the public version shipped ^[7][9]. The counter-case is that Fable 5's classifiers apply to every public user, attackers included ^[9], so a bank outside the list is no worse placed than anyone probing it with the public model. That case wins if banks outside Glasswing report defensive work on JPMorgan's scale using the public model alone.

The only federal body in either report is that task force. Task force member Scott Kupor has said companies would not receive a "free pass" but cautioned against rules that could limit US innovation, according to a report by The National News Desk ^[12]. The administration has said the US needs to avoid restrictions that could hinder development and allow China to gain a technological edge ^[13].