Security Brief for Central Banks and Regulators
QPQ AG, Zug, Switzerland – 20 April 2026
On 7 April 2026, Anthropic announced Mythos and Project Glasswing simultaneously. The two announcements cannot be understood separately: Mythos is the model; Project Glasswing is the defensive response to what it could do.
What it could do: Mythos autonomously identified and exploited a 27-year-old vulnerability in OpenBSD – an operating system known specifically for its security record – granting root access from anywhere on the internet, without authentication, without human involvement after the initial instruction. Root access means complete control: the ability to read every file on the system, install anything, delete anything, impersonate any user, and move silently to every connected system – invisibly, at machine speed.
Mythos found this flaw, built the exploit, and executed it autonomously. It can chain three to five such vulnerabilities end to end, and it found thousands of them across every major operating system and browser in production use.
The Response
Confronted with this, Anthropic initiated Project Glasswing, giving approximately 50 selected organisations – including Amazon Web Services, Apple, Google, JPMorganChase, Microsoft, and Nvidia – early access to scan and patch their own systems.
Within days, the US Treasury Secretary and Fed Chair convened Wall Street’s largest bank CEOs for the first joint emergency meeting of its kind since October 2008. The Bank of Canada convened its Financial Sector Resiliency Group. The Bank of England is convening its Cross Market Operational Resilience Group within the fortnight.
On 13 April 2026 the Cloud Security Alliance, SANS, OWASP, and a contributor list spanning the former directors of NSA cybersecurity and CISA, the Google Chief Information Security Officer, and the former US National Cyber Director consolidated this into an emergency framework: eleven priority actions for how the industry should respond, with their own caveat that “long-term goals should be considered a quarter away at most.”
Why That Response is Doomed to Expensive Failure
The official response has treated this as a security problem requiring better defences: the same tools, the same approach, the same vendors, with more urgency and even bigger cybersecurity budgets. From their perspective this is understandable. It is also wrong for two reasons.
Firstly, the dynamics are now permanently in the attacker’s favour.
An attacker needs one route to one credential. A defender has to stop every route, every time, forever. An attacker failing a thousand times costs nothing; one success compromises everything. A defender catching 99.9999% of attempts still lets 0.0001% through, and at machine speed, that fraction is all that is needed. One access point is enough to move laterally across every connected system.
Defensive AI does not close that gap; it cannot. Even the best-performing models hallucinate between 0.7% and 2% on the easiest tasks. The attacker needs the defender to be wrong once, and can run millions of probes in parallel at machine speed, across every exposed data set in the institution.
Moreover, however you judge Anthropic’s actions in this, Mythos is the first of its kind, not the last. Whatever emerges to compete with or succeed Mythos will share its properties. The defender is not up against a single model; they are up against a category of capability that will proliferate.
In this context, more defences and bigger cybersecurity budgets merely inflate the cost of inevitable compromise, harvesting and exploitation; the only variable is when.
The Architectural Error
Secondly, and most importantly, treating it as a security problem understates and mis-categorises it: correctly, it is an architectural problem that has been present for thirty years and has now become impossible to ignore.
The internet was built to share information. HTTPS made that transmission secure and universal. It works for its purpose. That is the Internet of Data, and it is what the cybersecurity industry has been built to defend.
What the internet was never built to carry is economic activity: the transmission of value, financial credentials, identity, payment instruments, sensitive economic records.
These have a property information does not have: they must not be copied. A news article exists to be copied; that is how it reaches its reader. A payment that has been copied is not a payment – it is an error, or it is theft. The property that makes the Internet of Data useful is the property that makes it unsafe for economic activity.
The financial system has run economic activity over information infrastructure for thirty years because no alternative existed. Thirty years of patches – tokenisation, encryption in transit, zero-trust, multi-factor authentication, hardware-backed credentials – are the industry’s accumulated attempt to close the gap, but ultimately it amounts to trying to make a car do what a ship does.
A car and a ship are not competing designs. They have different properties suited to different purposes. A car cannot cross an ocean and a ship cannot drive down a motorway. Both are necessary, and both have tooling appropriate to purpose. What the financial system needs – and has always needed – is an internet of economics with the appropriate tooling to protect rather than share data.
The Architectural Answer
The correct response is to remove sensitive economic data from the connected attack surface entirely. Not to defend it better in place. That separation now exists, is operational, and is open sourced, ready for immediate deployment.
QPQ AG, incorporated in Switzerland, has built the Internet of Economics – an open economic resource layer, together with the tooling to operate on it. All of it is open sourced, free to use, implement, and operate. One such tool is Gajumaru Remote
Instruction Dispatch and Serialisation – ‘GRIDS’ – the authentication and authorisation component, and the part that the Mythos announcement has made urgent.
The mechanism is straightforward to describe, once the purpose is understood. In the current architecture, customer authentication requires credentials and authentication material – passwords, session tokens, two-factor codes, signed cookies – to transit or sit on connected systems, where they can be harvested by an attacker who reaches those systems. Under GRIDS, the credential does not sit on any connected system. A cryptographic key, held inside the hardware secure enclave of the customer’s own phone or laptop, produces a mathematical proof that the customer has authorised this specific instruction. The institution receives the proof, verifies it against the customer’s public key – the mathematical counterpart, which is useless to an attacker – and acts on it. Nothing capable of authenticating anyone is ever present on a connected system.
GRIDS is a dead-drop signature protocol: the execution context (the connected device) and the signature context (the device holding keys) never share a direct connection.
How it works:
1. The connected device (terminal, computer, browser-facing interface) generates a transaction or authentication request and encodes it as a GRIDS URL or QR code.
2. This is passed – via URL paste or optical QR scan – to the signing device. No network connection between the two contexts.
3. The signing device decodes the request, displays what is being asked, and awaits approval.
4. The user approves. The signing device signs cryptographically and returns the signed response via QR code or URL.
5. The connected device receives cryptographic proof. No credentials. No private keys. No sensitive data of any kind transited the connected layer.
At no point do private keys exist on the connected device. Not briefly, not in transit, not encrypted in transit: not at all. The key is held in the signing context and never leaves it.
Each authentication creates a one-off cryptographic exchange between the institution and the customer’s device, open only for the duration of that specific instruction. When the instruction completes, it is gone. There is no persistent channel left behind for an attacker to find. There is no session state to hijack, no token to replay, no credential to retrieve in a subsequent breach. The attack surface that Mythos is built to exploit – the continuous presence of authentication data on connected systems – does not exist in a GRIDS flow, because the data is never placed on a connected system in the first place.
Anthropic has confirmed that Mythos can bypass two-factor authentication (‘2FA’). A GRIDS flow has no two-factor authentication to bypass. The entire category of harvestable credentials is absent.
There is no login. There is no password. There is no web socket exposure.
The same architecture applies to payment authorisation, to staff authentication into internal systems, to inter-institution messaging, to any interaction that currently depends on credentials being transmitted or stored. The institution’s connected systems hold public keys, delivery records, audit trails – none of which can authenticate anyone. They hold nothing Mythos is looking for.
No Account. No Password. No Database to Hack. This Is How Authentication Should Work.
End of the Mythos AI Threat: No Login. No Password. No Attack Surface – GRIDS Live Demos
GRIDS, Mythos AI, and the end of payment credentials in the public domain
Three Stages of Implementation
GRIDS is not a single product. It is an architectural protocol with a staged implementation path. Each stage addresses the remaining trust assumption of the stage before it.
Stage 1: Operational Now – Open Sourced
GajuDesk (desktop, all platforms) and GajuMobile (iOS and Android, releasing Q2 2026) implement GRIDS using the device’s hardware security enclave as the signing context.
Private keys are held in the secure enclave and never touch the broader operating system or any network-connected software layer.
This is a categorically different security posture from any browser-based financial interface: – Zero external software dependencies. Every line of code is written in-house and open sourced and auditable. No NPM packages, no frameworks, no anonymous dependency chains of the kind exploited in the September 2025 NPM supply chain attack that compromised 18 packages with more than 2 billion combined weekly downloads. – No browser plugin environment. The wallet does not run inside a browser. –
No web sockets, no logins, no passwords, no credential transmission of any kind.
Stage 1 has two honest limitations. The first is that the device holding the key is itself network-connected. The secure enclave is strong – the key never leaves it and cannot be extracted by software running on the operating system – but the device sits on the internet. That is a smaller attack surface than the current architecture by orders of magnitude, since Mythos or similar AI models cannot harvest a key that they cannot reach, but it is not zero.
The second is hardware provenance: a device manufactured under unknown conditions may carry hardware-level vulnerabilities that software inspection cannot detect.
Stage 1 is a strong immediate answer and remains useful for everyday transactions. The cost of compromising a well-implemented secure enclave on a connected device exceeds the value of most individual transactions by orders of magnitude. Stages 2 and 3 add coverage for flows where that calculus does not hold: high-value transactions, institutional treasury, inter-bank messaging, sovereign payment infrastructure. For those flows, the next stage removes the network connection entirely.
GajuDesk and GajuMobile – working applications that put GRIDS at the centre of their operation – are free to download and use. The GRIDS protocol is open sourced in its entirety under GPL3, auditable by anyone; any institution can implement it into its own infrastructure without any licensing cost. QPQ’s commercial offer is the integration expertise of the team that built it, and the Stage 2 and Stage 3 hardware programme.
Stage 2: GRIDS Hardware Wallet – In Development
A dedicated, air-gapped signing device whose sole function is to hold keys and execute cryptographic signing operations. It has no network connection of any kind: no Wi-Fi, no Bluetooth, no NFC, no cellular radio. The only communication channel is optical – QR codes displayed on its screen and read by its camera.
The connected device never has the keys. Every category of attack that depends on keys being present on a networked device – NPM supply chain attacks, browser exploitation, OS vulnerabilities, Mythos-class systematic scanning – is structurally eliminated. There is nothing to find because the keys are not there.
This stage is in development, dependent on Series A funding which QPQ is currently raising. Institutions wishing to accelerate this stage through partnership or advance commitment are invited to engage directly.
Stage 3: Full QPQ Hardware Stack – Sovereign Deployment
This is the stage most directly relevant to central banks and sovereign institutions. Stage 3 eliminates the remaining trust assumption of Stage 2: hardware provenance.
Stage 2 trusts that the GRIDS hardware wallet is manufactured without compromise.
Stage 3 addresses this by manufacturing both the signing device and, in partnership with sovereign actors, the connected devices within auditable, controlled facilities.
QPQ plans to establish global GRIDS device fabrication facilities in Switzerland and Japan – jurisdictions chosen for their regulatory stability, manufacturing capability, and alignment with the institutions QPQ serves. These facilities will be open to audit and inspection by any sovereign partner. The signing devices produced will have fully verified component-to-assembly manufacturing chains. No black-box components. No unverifiable supply chains.
For sovereign partners who want the capability in their own hands rather than purchased from ours, QPQ is open to establishing fabrication facilities within partner jurisdictions, including full technology transfer.
For a central bank seeking to protect national payment infrastructure, the full stack means:
• Signing devices manufactured in a facility you can audit, in a jurisdiction you trust
• A GRIDS protocol you can inspect, verify, and deploy on your terms
• Connected devices (terminals, mobile) whose manufacturing chain is verified to the same standard
Two Paths
QPQ has a commercial interest, and has stated it: Stage 1 open source and free; Stage 2 and Stage 3 hardware as the paid programme. That is the shape of our commercial offer.
The cybersecurity industry framework has its own commercial shape and does not state it. Its lead author has their own AI security tool recommended by name in the document, without disclosure. Training organisations, venture funds invested in security companies, and vendors of the specific products the document recommends are represented across the contributor list.
The more important difference is what each path resolves. The framework’s path buys time. Each additional investment in defence postpones the point at which a Mythos-class capability reaches a credential it can harvest, but none of the investment removes the credential from the place it can be harvested. The question the framework does not answer is where the spending ends, and what the institution is left with when it does.
Every cybersecurity budget that has risen for thirty years has been paying to defer an outcome the architecture makes inevitable. At machine speed against an attack surface that grows rather than shrinks, deferral has a shelf life.
The architectural path has an end state. Once sensitive economic data is no longer on the connected attack surface, the attacker has nothing to harvest and the defensive cost it incurred can be recovered. The institution is not buying more time, it is removing the risk.
The difference between QPQ’s position and the cybersecurity industry framework is not that one is commercial and the other is not. It is that one clearly defines its commercial interest, provides a free option with no compulsion to pay for anything, and actually solves the problem.
The Supervisory Question
“Adequate” security under every major prudential framework has meant adequate defence of credentials on connected systems, because there was nowhere else to put them. There is now. The question that follows is whether the standard should continue to mean what it has meant, or whether architectural removal of credentials from the connected attack surface should become part of what adequate protection requires.
The regulated population has been moving in this direction for a decade – tokenisation, data minimisation, zero-trust, secure-enclave credentials – and GRIDS is the completion of that direction rather than a deviation from it. The consequence for supervised firms would be significant. Cybersecurity budgets that have risen indefinitely to defend data on connected systems would reduce, because the attack surface those budgets defend would no longer exist in GRIDS flows. The security posture of the regulated estate would transform, because compromise would no longer depend on the next patch cycle outpacing the next exploit.
It is a question for the supervisory community, not for us. We have set out the diagnosis and the architecture as honestly as we can. The standard-setting is yours.
What We Are Proposing
Immediate:
A 15-20 minute live demonstration, on your own machine or ours. Download GajuDesk from gajumining.com/downloads; we will send installation instructions and a mining licence so you can log in yourself during the session. If local installation is precluded by policy, we screen share our own live operations.
Near term:
QPQ will work with any central bank, government agency, and related regulated firms to implement Stage 1 GRIDS across institutional interfaces – authentication, payment authorisation, inter-institutional communication. The protocol is open source. The cost is implementation time and any specific customisation, not licensing.
Medium term:
QPQ will accelerate Stage 2 hardware wallet development in partnership with institutions that commit to the programme. A sovereign institution’s commitment to deploy GRIDS hardware wallets across a defined user base changes the manufacturing economics and accelerates the timeline.
Long term:
QPQ is seeking sovereign partners for Stage 3 fabrication facilities. This is the Internet of Economics at institutional scale: national economic infrastructure in which sensitive financial data never touches the internet-connected layer, manufactured in a jurisdiction whose integrity can be assured.
Technical Summary
▶ Full Technical Reference: Un-White Paper – Section VIII: Security Architecture
