CERT-In Gets Anthropic's Mythos AI to Detect Vulnerable Systems With Cautious Testing Approach

CERT-In Gains Access to Anthropic's Mythos AI Model

India's nodal cybersecurity agency CERT-In has secured access to Anthropic's Mythos AI model, marking a development in the country's cyber defense capabilities1

1

2

2

. The Computer Emergency Response Team, operating under the Ministry of Electronics and Information Technology, will begin leveraging this advanced AI system to identify cyber vulnerabilities and strengthen responses to emerging cyber threats. Mythos represents Anthropic's most powerful AI model, specifically trained for cybersecurity, reasoning, and complex research-based tasks3

3

. The model is currently available only to a small group of trusted organizations due to concerns about potential misuse of its capabilities.

Measured Approach to Testing Amid Data Security Risks

Despite gaining access, CERT-In is adopting a cautious and calibrated approach to assess how Anthropic's Mythos AI model can be utilized within India's national cybersecurity infrastructure2

2

. IT Ministry sources emphasized the agency will "slowly route anything we want to test," acknowledging that "the cure should not be worse than the problem"2

2

3

3

. The primary concern stems from Mythos operating in a cloud-based environment. Government agencies cannot download the AI's source code or weights for running on completely isolated or air-gapped systems1

1

. Instead, they must send proprietary data, code, or network blueprints over the internet to Anthropic's cloud servers for processing, raising data security risks that require careful evaluation.

Capabilities to Detect Vulnerable Systems

The Mythos AI model is expected to enable CERT-In to detect vulnerable systems and recommend patches across government infrastructure3

3

. CERT-In's focus will initially center on understanding the model's capabilities, potential applications, and associated risks before considering wider usage2

2

. According to reports, CERT-In's current AI models deliver 80-85 per cent of Mythos's capabilities, suggesting the new system offers enhanced performance for identifying and addressing cybersecurity threats3

3

. The agency will start experimenting with the model through a slow, methodical process to ensure responsible AI use while maintaining security standards.

Dual-Use Nature of AI Raises Governance Concerns

The deployment highlights growing concerns over the dual-use nature of AI in cybersecurity, where capabilities designed to identify and address vulnerabilities could potentially be exploited by malicious actors to launch sophisticated cyberattacks2

2

. This reality underscores why Anthropic has restricted Mythos access to select organizations. The development comes as India advances broader AI governance frameworks. TRAI recently proposed comprehensive draft guidelines requiring telecom service providers to adopt board-approved AI policies, establish dedicated governance and safety committees, and report serious AI-related incidents2

2

3

3

. The Ministry of Electronics and Information Technology is simultaneously preparing a consultation paper on AI regulations covering AI safety, deepfakes, and human-first approaches2

2

3

3

. IT Ministry sources indicated that sector-specific norms are appropriate since AI's impact varies significantly across industries, with some critical infrastructure sectors facing substantially larger risks requiring tighter regulations2

2

.