ASA Urges Secretary Bessent to End CAT’s Use of American Investor Personal Information in Wake of Anthropic's Claude Mythos Revelations

WASHINGTON – The American Securities Association (ASA) today sent a letter to Treasury Secretary Scott Bessent, in his capacity as Chairman of the Financial Stability Oversight Council (FSOC), calling for action to protect American investors from the cybersecurity risk posed by the Securities and Exchange Commission's (SEC) Consolidated Audit Trail (CAT) in the wake of Anthropic's Claude Mythos AI model.

"ASA commends Secretary Bessent and Federal Reserve Chair Powell for convening the nation's largest bank CEOs to address the existential cybersecurity threat exposed by Anthropic's Claude Mythos Preview," said ASA President and CEO Christopher Iacovella. "The subject matter of that emergency meeting confirms what ASA has warned about for years: the SEC's Consolidated Audit Trail is a significant cybersecurity vulnerability waiting to be exploited."

"The Consolidated Audit Trail, as it is currently designed, is the single greatest concentration of investor data in American history. It sits at the intersection of every risk that Mythos has now made operational, and it must be reformed," Iacovella wrote in the letter.

The CAT's Customer and Account Information System (CAIS) is the world's largest database of retail and institutional trading data ever assembled, containing the name, address, year of birth, account type, account number, and complete transaction history of every retail brokerage customer in America. The government is using this data to create an investor specific identifier, called the CCID, that will link every American investors’ intimate personal information to their brokerage accounts and be used to track them around the financial markets without any evidence of wrongdoing (think of the CCID as a government mandated ankle bracelet that every investor must wear just in case they commit a crime).

ASA's call for action includes:

1. Require the immediate suspension of all collection and retention of retail investor PII in the CAT’s Customer and Account Information System and destroy all the data it has collected. 

2. Immediately end the use of any investor PII to create individual customer identifiers that the CAT uses to surveil American investors and that Mythos-class threat models can exploit. 

3. Order an immediate, independent cybersecurity audit of the CAT's full technology stack conducted against a Mythos-class threat model. 

4. Direct the SEC to formally adopt its long-pending August 2020 CAT data security proposal eliminating bulk downloading and ending the collection and use of retail investor personal and financial information. 

5. Work with Congress to enact the Protecting Investors’ Personally Identifiable Information Act, which would replace the CAT’s bulk-collection model with a request/response-based framework that preserves full regulatory authority while eliminating the single-point-of-failure risk that the CAT currently represents.

To read ASA's full letter, click here.

###

The American Securities Association (ASA) represents the retail and institutional capital markets interests of regional financial services firms who provide Main Street businesses with access to capital and advise hardworking Americans how to create and preserve wealth. ASA’s mission is to promote trust and confidence among investors, facilitate capital formation, and support efficient and competitively balanced capital markets. This mission advances financial independence, stimulates job creation, and increases prosperity. The ASA has a geographically diverse membership of almost one hundred members that spans the Heartland, Southwest, Southeast, Atlantic, and Pacific Northwest regions of the United States.