CERT-In uses Anthropic's unreleased Mythos to find software flaws

India's cybersecurity agency, the Indian Computer Emergency Response Team, has been granted access to Anthropic's unreleased artificial intelligence model Mythos, government sources told CNBC-TV18. CERT-In is using the model to identify weaknesses in vulnerable systems and recommend patches to fix them, the sources said.

The access gives CERT-In a tool that CNBC-TV18 described as having particularly advanced capabilities in uncovering cybersecurity vulnerabilities. It also means sensitive information about potentially critical systems may need to be shared with a cloud platform, a concern the report highlights.

Cloud access raises data concerns

The model's cloud-based availability has raised concerns within the government, according to the report. Officials are wary of sending sensitive information to cloud platforms, given the risks involved in sharing data about potentially critical systems.

For a national computer emergency response team, the data question is operational. The systems CERT-In examines may be critical, and the information it shares with a cloud platform may reveal weaknesses. YourStory reported that security teams routinely handle confidential source code, network logs and incident reports, and that sending such information to external platforms can raise concerns around privacy, access and regulatory compliance.

CERT-In is not relying on Mythos alone. The agency is also using several other AI models to detect system vulnerabilities, and those models can deliver around 80-85% of the capabilities offered by Mythos, government sources told the outlet. Using multiple models could help the agency identify security gaps while limiting concerns about how sensitive information is handled. The cloud-based deployment of Mythos remains a central consideration.

Limited access through Project Glasswing

Mythos is unreleased, and Anthropic has provided limited access to selected organisations and agencies through Project Glasswing, according to CNBC-TV18. The initiative focuses on finding and fixing weaknesses in critical information technology systems. It is intended to help participants identify security flaws before malicious actors can exploit them. The model is not publicly available.

The 80-85% figure means the other models cover most, but not all, of Mythos's capabilities. That shortfall matters if Mythos can find flaws the other models miss. Mistral AI has released the weights for its Large 4 cybersecurity model so organisations can download and run it within their own infrastructure, YourStory reported, an approach that gives greater control over where the AI runs and how data is handled. That approach still requires technical expertise and security processes to manage effectively.

For CERT-In, the immediate task is narrow: use Mythos to find weaknesses and recommend fixes, while weighing whether cloud access is acceptable for the systems it examines.