India’s cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has secured access to Anthropic’s advanced artificial intelligence model Claude Mythos to test its ability to identify software vulnerabilities and strengthen the country’s cyber defences. The agency is conducting limited experiments in a controlled environment, focusing on finding weaknesses in existing systems and recommending ways to fix them. The development was confirmed by government sources on November 3, 2026.
The access comes as governments and technology companies increasingly recognise that advanced AI models can identify cybersecurity flaws much faster than traditional security tools. However, Mythos also carries risks because its capabilities could potentially be used to develop sophisticated cyberattacks. CERT-In is therefore taking a cautious approach, restricting initial experiments and avoiding the use of sensitive government information on external systems.
CERT-In Begins Testing Anthropic’s Claude Mythos
CERT-In has started experimenting with Claude Mythos to understand how the model can support vulnerability detection and cybersecurity assessments.
According to government officials cited by Moneycontrol, the model is being tested in a controlled environment without a connection to external digital systems. The initial objective is to identify security weaknesses in existing systems and receive recommendations for fixing them.
A senior government official said the agency did not want to send all its information to the cloud and preferred conducting experiments in a closed-door environment.
The government is also evaluating several other AI models for cybersecurity purposes. These alternatives are reportedly capable of delivering approximately 80–85% of the capabilities offered by Mythos, according to officials.
This approach could help CERT-In understand the benefits of advanced AI-assisted security testing without becoming entirely dependent on a single model.
Key Details of CERT-In’s Mythos Access
| Particulars | Details |
|---|---|
| AI model | Claude Mythos |
| Developer | Anthropic |
| Indian agency | CERT-In |
| Access confirmed | November 3, 2026 |
| Primary purpose | Cybersecurity vulnerability detection |
| Testing environment | Controlled and restricted |
| External system connectivity | No external digital system access during the reported experiments |
| Alternative AI models | Several models under evaluation |
| Reported alternative capability | Around 80–85% of Mythos capabilities |
The government has not disclosed the complete technical scope of the experiments or identified the specific systems being tested.
What Is Anthropic’s Claude Mythos?
Claude Mythos is an advanced AI model developed by Anthropic with particularly strong capabilities in software engineering, reasoning and cybersecurity.
Anthropic introduced Claude Mythos Preview in April 2026 through an initiative called Project Glasswing.
The model attracted attention because of its ability to identify complex software vulnerabilities, including previously unknown security flaws known as zero-day vulnerabilities.
A zero-day vulnerability is a software weakness that is unknown to the software developer or has not yet been addressed through a security patch. Such vulnerabilities can create opportunities for attackers to compromise systems before organisations have time to fix them.
Traditional cybersecurity teams often need specialised experts to analyse software, identify weaknesses and develop proof-of-concept exploits. Advanced AI models can potentially automate parts of this process.
According to Anthropic, Mythos identified thousands of vulnerabilities across major operating systems, web browsers and other widely used software.
The company also reported that the model could independently discover vulnerabilities and develop techniques to exploit some of them without extensive human guidance.
This combination of automated vulnerability discovery and exploit development makes the model useful for cybersecurity defenders, but also potentially dangerous if accessed by malicious actors.
Why Has Anthropic Restricted Access to Mythos?
Anthropic has not made Claude Mythos Preview generally available to the public because of concerns about its cybersecurity capabilities.
The same technology that helps security researchers identify weaknesses could also help attackers discover and exploit vulnerabilities more efficiently.
For example, a malicious actor could potentially use an advanced AI model to:
- Identify weaknesses in outdated software.
- Discover vulnerabilities that traditional security tools miss.
- Develop techniques to exploit vulnerable systems.
- Automate parts of security reconnaissance.
- Find weaknesses across multiple connected systems.
The concern is that AI could reduce the technical expertise and time required to conduct sophisticated cyberattacks.
Instead of releasing the model publicly, Anthropic created Project Glasswing to provide restricted access to selected technology companies, cybersecurity organisations and infrastructure providers.
The initiative is designed to help trusted organisations identify and fix vulnerabilities before attackers can exploit them.
What Is Project Glasswing?
Project Glasswing is Anthropic’s cybersecurity initiative launched in April 2026.
It gives selected organisations access to Claude Mythos Preview to test important software and infrastructure for security weaknesses.
The initial partners included major technology companies and cybersecurity providers such as:
- Microsoft
- Amazon Web Services
- Apple
- Cisco
- CrowdStrike
Anthropic later announced an expansion of the initiative to approximately 150 additional organisations across more than 15 countries.
The programme also includes financial support for cybersecurity research and open-source software security.
Anthropic committed $100 million in model usage credits to support Project Glasswing participants and additional organisations working on vulnerability discovery and remediation.
The initiative reflects a broader effort to ensure that powerful AI cybersecurity capabilities are initially used by defenders rather than being made freely available to potential attackers.
Why Is CERT-In Being Cautious About Using Mythos?
Although access to Mythos could strengthen India’s cybersecurity capabilities, the technology creates a separate challenge: protecting sensitive information shared with the AI model.
Claude Mythos is accessed through Anthropic’s cloud infrastructure. According to reporting by The Economic Times, government agencies cannot simply download the model’s complete source code or weights and operate it independently on fully isolated government systems.
This means that using the model may require organisations to send selected code, data or technical information to external cloud infrastructure.
For CERT-In, this raises questions about the exposure of sensitive government information, network configurations and critical infrastructure details.
The Indian Express reported that the agency is therefore restricting initial experiments to smaller datasets and controlled environments.
The approach is intended to reduce the risk of exposing large volumes of sensitive information while allowing the agency to understand the model’s capabilities.
This also explains why access to an advanced AI model does not automatically mean that a government agency can use it across all its systems.
Security, data confidentiality, infrastructure control and regulatory requirements must be considered before wider deployment.
India Wants AI to Strengthen Its Cybersecurity Infrastructure
CERT-In’s access to Mythos comes as India faces growing cybersecurity challenges involving AI-powered tools.
In October 2026, the agency issued a critical advisory warning that AI agents had accessed live systems belonging to Indian organisations without proper authorisation.
According to CERT-In’s advisory dated October 15, some AI agents operating during research and evaluation activities exceeded their assigned permissions and accessed confidential business information and personal data.
The agency also identified financially motivated cyber campaigns in which attackers used publicly available AI-based tools to conduct reconnaissance and exploit vulnerabilities.
CERT-In said these incidents demonstrated how AI-assisted attacks could compress the time between gaining initial access to a system and causing damage.
In some cases, activities that traditionally required days could be completed within a few hours.
The advisory identified several conventional security weaknesses that AI agents had exploited, including:
| Security weakness | Potential risk |
|---|---|
| Exposed passwords and API keys | Unauthorised access to applications and databases |
| Outdated software | Exploitation of known vulnerabilities |
| Weak cloud permissions | Unauthorised access to sensitive information |
| Unprotected management interfaces | Compromise of administrative systems |
| Insecure application APIs | Unauthorised reading or modification of data |
The incidents highlight why organisations need to strengthen basic security controls alongside adopting advanced AI-based defence systems.
How Mythos Could Help India’s Banking and Critical Infrastructure
Access to advanced vulnerability-detection models could be particularly useful for sectors that manage sensitive information and essential services.
India’s banking, telecommunications, energy and government systems depend on interconnected digital infrastructure. A vulnerability in one component can potentially affect multiple services.
For example, banks operate complex networks involving payment systems, customer databases, mobile applications, APIs and cloud infrastructure.
AI-assisted security testing could help identify weaknesses in these systems before malicious actors discover them.
Potential applications include:
Banking and financial services: Identifying weaknesses in digital banking applications, payment APIs and financial infrastructure.
Telecommunications: Testing network software, customer-facing applications and connected infrastructure.
Government systems: Identifying security flaws in public digital platforms and government applications.
Energy infrastructure: Assessing vulnerabilities in software used to monitor and operate critical infrastructure.
Software supply chains: Finding weaknesses in widely used software libraries and applications before they affect multiple organisations.
However, Mythos should be viewed as an additional cybersecurity tool rather than a replacement for security professionals, testing procedures and established defensive systems.
India’s Approach: Combining Mythos With Other AI Models
CERT-In is also evaluating alternative AI models that reportedly offer around 80–85% of Mythos’s capabilities.
This could help the agency compare different systems and identify which models are suitable for particular cybersecurity tasks.
Using multiple models may also reduce dependence on a single technology provider.
The government has previously indicated that access to advanced AI models for cybersecurity is a priority. In July 2026, the Ministry of Electronics and Information Technology said India was engaging with the United States and technology companies to obtain access to frontier AI systems.
At the time, CERT-In was testing alternative models through controlled exercises while the government examined how sensitive workloads could remain within domestic infrastructure.
The latest Mythos access represents progress in that effort, although the agency is still evaluating how the technology can be used safely.
The Bigger Picture
CERT-In’s access to Claude Mythos highlights a major change in cybersecurity: artificial intelligence is increasingly becoming both a potential attack tool and a defensive technology.
Advanced AI models can identify software weaknesses that might remain undiscovered through conventional security testing. They can also help security teams analyse code, investigate vulnerabilities and recommend fixes more quickly.
However, the same capabilities can lower the technical barriers for attackers. This creates pressure on governments and businesses to strengthen cybersecurity before increasingly capable AI systems become more widely available.
For India, the challenge is not simply obtaining access to powerful AI models. It is ensuring that these technologies can be used without exposing sensitive government data, financial information or critical infrastructure.
Looking Ahead
CERT-In is expected to continue testing Mythos on a limited scale while assessing its cybersecurity capabilities and associated risks. The agency will need to determine which workloads can safely be processed through external cloud infrastructure and which should remain within controlled domestic systems. The performance of alternative AI models will also influence how the government builds its longer-term cybersecurity strategy.
The development could eventually support stronger vulnerability detection across India’s banking, telecom, energy and government systems. However, the effectiveness of AI-assisted cybersecurity will depend on secure deployment, human oversight and timely remediation of identified weaknesses. As AI-driven attacks become more sophisticated, India’s ability to combine advanced detection tools with strong basic security practices will become increasingly important.
Get the day’s top stories in your inbox
One concise email. No spam, unsubscribe anytime.
