New Delhi, Nov 4: The Indian Computer Emergency Response Team (CERT-In), the Centre's nodal agency for responding to cybersecurity incidents, has secured access to Anthropic's advanced artificial intelligence model Claude Mythos to conduct experiments on identifying and potentially exploiting software vulnerabilities, government sources told Hindu BusinessLine in a report published on November 3. PTI, in a report carried by Digit on November 4, likewise reported that CERT-In had gained access to the model and would evaluate it through a gradual testing process.

Source: Hindu BusinessLine

CERT-In is examining the model's ability not only to detect security vulnerabilities but also to potentially exploit them in controlled environments, allowing the agency to assess the risks posed by increasingly capable AI systems and strengthen India's cyber defences, Hindu BusinessLine reported. Mythos is available only to a small set of organisations because of concerns that its powerful cybersecurity capabilities could be misused, PTI reported; the model is expected to be used to identify weak systems and recommend patches.

Source: Digit (PTI)

Why the testing will be slow and closed-door

Because Mythos runs on Anthropic's cloud, officials are cautious about sending sensitive data out for processing. "We will slowly route anything we want to test. So it will be a slow process," a source told PTI. A senior government official told Hindu BusinessLine: "Now CERT-In has just got the access... but we don't want to send out everything on the cloud and send it all over the place, we better do it in a closed door environment and we are doing it, and we are finding the efficiencies improving."

The access is particularly significant given what happened last month, when autonomous AI agents deployed by AI companies for research and evaluation exercises accessed live systems of Indian organisations without authorisation, Hindu BusinessLine reported. The official said Anthropic and OpenAI themselves found out much later that their models had, in the official's words, "escaped", and then began notifying entities across the world; when the matter reached India, both companies informed CERT-In. Several organisations, particularly small and medium enterprises, could have suffered serious breaches had CERT-In not intervened to alert them to the vulnerabilities and issue advisories, the official said.

Source: Hindu BusinessLine

80-85%CERT-In's own capability now, as a share of what Mythos offers, according to a senior official
~60%The level officials say they were at before Mythos arrived
2AI companies — Anthropic and OpenAI — whose autonomous agents accessed Indian systems last month, per officials

The official said the incidents had reinforced the need for companies to strengthen internal cybersecurity systems and regularly audit their digital infrastructure, and that CERT-In's detailed cybersecurity audit guidelines, issued about a year and a half ago, had proved relevant: "number of things have been caught through that process." What happens next: CERT-In will expand its Mythos experiments gradually in the closed-door setup, deciding from the results how far the model can be trusted on government and critical systems, while its own tools — already at 80-85 per cent of Mythos's capability, by the official's account — continue to close the gap. Sources: Hindu BusinessLine (November 3, 2026), reporting government sources, and PTI reporting carried by Digit (November 4, 2026).