The New York Stock Exchange has used Anthropic’s Mythos AI model to identify and address multiple vulnerabilities in its cybersecurity systems, illustrating how artificial intelligence is moving into the defensive layer of critical financial infrastructure. The development comes as exchanges, banks and other financial institutions face increasingly sophisticated cyber threats while AI systems become capable of discovering software vulnerabilities at a scale that traditional security teams may struggle to match.

NYSE Applies Mythos to Financial Infrastructure

NYSE President Lynn Martin disclosed that the exchange participated as an early partner in Anthropic’s Project Glasswing and used the company’s Mythos model to test its cybersecurity defenses. According to Martin, the technology identified multiple issues that the exchange was able to address quickly. The specific vulnerabilities, however, were not disclosed, and NYSE did not provide a timeline for when the identified issues were resolved.

The deployment is part of a broader initiative by Intercontinental Exchange, the parent company of NYSE. ICE announced in June that it had deployed Claude Mythos Preview across its businesses, including exchanges, clearinghouses, data services and its mortgage technology platform. The company said the model was being used to identify and remediate vulnerabilities before they could be exploited through emerging AI capabilities.

Project Glasswing Turns AI’s Cyber Capabilities Toward Defense

Anthropic launched Project Glasswing in April as a controlled-access initiative designed to use frontier AI to secure critical software. The company said its initial partners had used Mythos Preview to identify thousands of zero-day vulnerabilities, including high- and critical-severity flaws across major operating systems, web browsers and other widely used software.

By June, Anthropic said approximately 50 initial partners had found more than 10,000 high- or critical-severity vulnerabilities. The company subsequently expanded the program to approximately 150 additional organizations across more than 15 countries, including providers of power, water, healthcare, communications and hardware infrastructure.

The scale of the findings changes the cybersecurity equation. Anthropic has argued that the bottleneck is increasingly moving away from discovering vulnerabilities toward verifying, disclosing and patching them. Mythos can also assist with writing patches, penetration testing, threat detection and response, allowing AI to participate in multiple stages of the defensive process.

Financial Markets Face a Higher Cybersecurity Standard

The NYSE deployment is particularly significant because exchanges and clearinghouses represent systemically important financial infrastructure. A successful cyberattack against such systems could disrupt trading, clearing, market data and other functions that connect investors, financial institutions and corporations across global markets.

ICE has emphasized that its implementation is designed to be secure, auditable and appropriate for regulated industries. The controlled-access structure of Project Glasswing is also important because the same AI capabilities that can identify weaknesses for defenders could potentially be used by attackers. Anthropic has warned that more AI companies are likely to develop Mythos-class cyber capabilities, potentially increasing the frequency and sophistication of attacks if adequate safeguards do not keep pace.

AI Defense Could Become Part of Core Market Infrastructure

The NYSE’s experience suggests that AI-based vulnerability discovery could increasingly become a standard component of cybersecurity for financial institutions rather than an experimental technology. For regulated organizations, the potential advantage is the ability to continuously examine complex software environments and identify weaknesses before malicious actors discover them.

At the same time, the approach introduces new governance requirements. AI-generated security findings must be validated, prioritized and safely acted upon, particularly within systems where an incorrect automated intervention could itself create operational risks. Anthropic’s restricted access to Mythos-class models reflects the sensitivity of this technology and the difficulty of balancing defensive access with misuse prevention.

Going forward, the key developments will be whether NYSE and other financial institutions expand the use of frontier AI for continuous vulnerability testing, how quickly identified vulnerabilities can be patched, and whether regulators establish new expectations for AI-assisted cybersecurity. The broader significance is that AI is increasingly becoming both a cyber risk and a core defensive capability, making the ability of financial infrastructure operators to keep pace with rapidly advancing models an increasingly important element of market resilience.