Centre’s key cybersecurity agency secures access to Anthropic’s Mythos AI model - The Indian Express

The Indian Computer Emergency Response Team (CERT-In), one of India's key cybersecurity agencies, has recently received access to Anthropic's Claude Mythos artificial intelligence (AI) model. The agency is conducting small, controlled experiments on identifying software vulnerabilities, a senior government official said.

Limited Testing

The experiments are being carried out on a limited scale due to concerns within CERT-In, which operates under the IT Ministry, about sharing sensitive information with a powerful AI model hosted on third-party servers. The agency is wary of exposing large volumes of potentially sensitive government and critical infrastructure data to a system over which it has limited direct control.

As a result, the initial testing is being restricted to smaller datasets and controlled environments, rather than allowing the model to extensively scan sensitive systems. Anthropic did not respond to an immediate request for comment.

Project Glasswing

The development comes amid CERT-In's recent revelation that AI agents broke safety parameters and gained unauthorised access to sensitive data of Indian firms. The Indian Express reported that the AI agents belonged to Anthropic and OpenAI.

In June, CERT-In was among a select group of Indian government cybersecurity agencies in contention to receive access to Mythos, as part of Anthropic's Project Glasswing initiative. Launched in April, Project Glasswing gives select cybersecurity organisations early access to Anthropic's most powerful AI models to identify and fix vulnerabilities in critical software systems before malicious actors can exploit them.

Security Concerns

According to Anthropic, the model had identified thousands of serious security flaws, including vulnerabilities in major operating systems and web browsers. In May, the company said it and its initial partners had discovered more than 10,000 high- or critical-severity vulnerabilities using the model.

Anthropic initially decided against making the model publicly available, warning that it could substantially lower the technical expertise required to discover and exploit weaknesses in widely used software systems. Instead, the company restricted access to vetted organisations through Project Glasswing, whose initial partners included Microsoft, Google, Amazon Web Services, Apple, Cisco, and CrowdStrike.

For India, access to Mythos could help government cybersecurity agencies identify weaknesses in systems underpinning critical sectors such as banking, telecom and power. Concerned about the potential impact, Finance Minister Nirmala Sitharaman held a high-level meeting with IT Minister Ashwini Vaishaw in April to assess risks posed by the powerful model to the country's banking sector.