Indian Finance Ministry warns banks of cybersecurity risks from Anthropic's Mythos AI
India's Finance Ministry held a meeting with bank leaders to warn of cybersecurity risks from Anthropic's Claude Mythos AI model, which can identify system vulnerabilities that humans cannot detect. The government described the risks as unprecedented and took steps to strengthen threat intelligence sharing and coordination among financial institutions.
What happened
Finance Minister Nirmala Sitharaman held a high-level meeting with heads of public and private sector banks on cybersecurity risks posed by Anthropic's Claude Mythos AI model.
Claude Mythos is claimed to be the most advanced AI model for cybersecurity, capable of identifying vulnerabilities in banking systems that humans have failed to detect for years, including bugs in 27-year-old systems. The model is restricted from public release and limited to select companies including Amazon, Microsoft and Google, though reports indicate unauthorized access has occurred.
Reported impact
The Finance Ministry described the risks from Mythos as 'unprecedented', requiring very high levels of vigilance, readiness and improved coordination between financial institutions and banks.
The government expressed concern that if the technology reaches the wrong hands, it could be used for large-scale cyberattacks. If misused by malicious actors, the AI's ability to discover vulnerabilities could enable attacks on banking systems.
Index analysis
The potential risk stems from Mythos being capable of discovering security flaws in legacy banking systems and infrastructure that were built without adequate security considerations, particularly in code from the 1990s that underpins modern systems.
The dual-use nature of the technology—beneficial for legitimate cybersecurity defense but dangerous if misused—creates a governance challenge regarding access control and monitoring of the AI model.
Governance controls
Banks were instructed to strengthen IT systems and ensure customer data protection. The government directed development of a real-time threat intelligence sharing system with the Indian Computer Emergency Response Team and other agencies to enable rapid detection and communication of cyber threats across the banking system.
The Indian Banks' Association was asked to prepare a coordinated response system to counter potential attacks quickly. The Finance Ministry is treating the potential threat with serious consideration.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.