Unpopular Opinion: Banks Should Stop Panicking About AI Hacking Their COBOL and Start Asking Why Their "Modern" Systems Are the Actual Problem r/cybersecurity | r/programming | r/sysadmin
​
So there's been a lot of noise lately about Anthropic's Claude Mythos model being able to "read COBOL" and hack bank mainframes. Headlines are screaming. Bank CEOs are in emergency meetings. Cybersecurity vendors are rubbing their hands together.
I want to push back on basically all of it — because I think the entire conversation is technically confused, and the industry is about to spend billions fixing the wrong thing. Again.
Let's Start With the "AI Can Read COBOL and Hack Banks" Claim
Here's the thing nobody seems to be saying out loud: COBOL isn't exposed to the outside world.
Bank mainframes run compiled object code on z/OS. There's no scenario where an attacker reaches in from the internet, pulls out COBOL source, and "compromises" it. The source isn't sitting there. The attack surface isn't the language — it's the interfaces sitting in front of the COBOL.
So when the media says "Mythos can read COBOL and figure out how to compromise it" — that's not really how any of this works. What Mythos can actually do is:
Analyse publicly available COBOL modules and documentation
Read API specs, SWIFT/ACH protocol documentation, and infer what the underlying logic does
Perform smarter black-box fuzzing against exposed interfaces
Map inter-system dependencies to find cascade failure points
The attack isn't reading the binary. It's reasoning about what the system does based on observable behaviour and public information, then crafting inputs that exploit logical flaws. That's a real threat — but it's a threat to the middleware and API layer, not to COBOL itself.
Okay So If the Code Isn't the Problem, Why Is Everyone Trying to Fix the Code?
Great question. Here's why:
Auditors and regulators think in terms of code review. PCI-DSS pushes toward source-level audit. That's the framework, so that's what gets measured.
Vendors selling COBOL modernization tools have a very obvious financial interest in framing the problem as "fix or replace the COBOL." Funny how that works.
Executives can see a migration roadmap in a board presentation. "We hardened the perimeter architecture" is harder to put a number on.
Liability optics — after a breach, "we reviewed and patched the code" looks better in an incident report than "we improved our network segmentation."
But here's the uncomfortable truth: you could rewrite every line of COBOL in modern Go or Java tomorrow, and if the architecture isn't fixed, the same vulnerabilities exist. A settlement timing gap between a mainframe batch job and a real-time API gateway is a design problem, not a language problem.
Has a Mainframe Actually Ever Been Directly Hacked?
Barely. And the pattern in every confirmed case is identical.
Equifax 2017 — 147 million Americans' data stolen. Entry point: an unpatched Apache Struts vulnerability in a consumer web app. Attackers then moved laterally through shared identity stores until they reached mainframe-integrated systems. The mainframe wasn't the door. It was the destination.
JPMorgan Chase 2014 — 76 million households exposed. Same story: external system compromised first, lateral movement from there.
Logica/Nordea Sweden 2012 — The most technically interesting case. A hacker actually did get shell access to an IBM z/OS mainframe. How? By compromising another server first, then hopping machine to machine through shared network segments until reaching the mainframe. It remains one of the only confirmed direct mainframe breaches ever documented.
The pattern is clear: nobody kicks down the mainframe's front door because it doesn't have one. They find a window in the house next door and walk through the connecting corridor.
So Here's The Unpopular Part
If security were the primary criterion for infrastructure investment decisions — which it arguably should be for banks — mainframes would be winning every conversation.
Think about what mainframes actually get right:
Pervasive encryption at rest and in transit — by default, not bolted on later
RACF: granular access control baked into the OS at the hardware level
Dedicated crypto silicon — not software crypto, actual hardware
No lateral movement possible within the mainframe itself
Every transaction logged with zero gaps, by design
Now think about what "modern" cloud-native distributed systems get wrong:
Every microservice is an attack surface
Every API endpoint is a door
Every third-party npm package is a potential supply chain attack (hi, Log4Shell)
Kubernetes misconfigurations expose production data routinely
The complexity that makes modern systems "flexible" is exactly what makes them a nightmare to secure
The industry spent 20 years running away from mainframes toward microservices, cloud-native, and distributed architectures — in the name of modernisation. Meanwhile cloud breaches happen daily, and the average cost of a cloud breach in 2024 exceeded $4.8 million.
The mainframe quietly processes $10 trillion in transactions daily. With almost zero confirmed direct breach incidents in its entire history.
Why Doesn't Anyone Say This Out Loud?
Because there's a trillion-dollar cloud industry whose entire narrative depends on "legacy bad, cloud good."
Because mainframe skills are scarce and expensive — it's easier to sell "rewrite in React" than train z/OS engineers.
Because "legacy" is a pejorative that drives decisions more than actual threat modelling does.
The smartest banks actually run both — mainframe as the trusted, hardened core for transactions and records, with modern systems strictly at the presentation layer, tightly isolated. The ones that got breached are the ones that let those two worlds bleed into each other without proper controls.
TL;DR
Mythos can't "hack COBOL" directly — COBOL isn't exposed
Every real mainframe-adjacent breach came through modern systems, not the mainframe
Fixing COBOL code addresses the wrong problem — the architecture around it is the risk
Mainframes are arguably the most secure production infrastructure ever built
The industry is about to spend billions on the wrong fix because vendors, regulators, and executives are all incentivised toward the wrong answer
The fancy new systems are the vulnerability. The 50-year-old mainframe is quietly doing its job.
Curious if anyone in the r/sysadmin or r/mainframe community has actually worked on z/OS security and wants to weigh in. Am I missing something here, or is this as backwards as it looks from the outside?
Tags: #mainframe #cybersecurity #COBOL #zOS #banking #infosec #IBM #cloudcomputing #techdebt