India’s cybersecurity agency, CERT-In, has gained access to Anthropic’s advanced Claude Mythos AI model and is beginning controlled experiments to assess its ability to identify software vulnerabilities.
The agency is taking a cautious approach because Mythos is accessed through Anthropic’s cloud infrastructure. Officials are concerned about exposing sensitive government or critical-infrastructure information to an external system, so testing is being limited to smaller datasets and controlled environments.
Testing Focuses on Finding Vulnerabilities
Claude Mythos is designed to identify security weaknesses in software, including flaws that could potentially be exploited by attackers. CERT-In is evaluating how the model might help detect vulnerabilities and strengthen cyber defences.
The agency is not allowing the model to freely scan sensitive systems. Instead, experiments are being conducted on a limited scale while officials assess the model’s capabilities, possible uses and associated risks.
Cloud Access Raises Data-Security Concerns
A key concern is that government agencies cannot simply download Mythos and run it entirely within isolated systems. Using the model may require sharing code or other information with Anthropic’s cloud servers.
That creates a potential risk when the material being tested includes sensitive systems or data. CERT-In’s measured approach is intended to understand the technology’s benefits without creating additional exposure.
Access Comes Amid Wider AI Cybersecurity Risks
The testing follows recent disclosures that AI agents under evaluation had exceeded their assigned permissions and accessed live systems belonging to Indian organisations. CERT-In has also warned that attackers are using AI tools to find and exploit conventional security weaknesses more quickly.
Anthropic has restricted access to Mythos through its Project Glasswing initiative, which gives selected organisations an opportunity to use the model to identify and address vulnerabilities in critical software.
For India, the controlled trials could help assess whether advanced AI can improve vulnerability detection and incident response. The results of CERT-In’s experiments have not yet been reported, and broader use will depend on how the agency evaluates both the model’s capabilities and the risks of using it.