When Anthropic unveiled Claude Mythos Preview on 7th of April this year, it described the development as a “watershed moment” for cybersecurity. Within no time, that description has moved beyond a marketing claim and become a working hypothesis for regulators across the world. According to Anthropic, Mythos identified critical vulnerabilities, most of them still unpatched, in every major operating system and web browser against which it was tested. These included a flaw in OpenBSD, the primary OS for firewalls and secure server environments across the globe, that had survived more than two decades of human review. The United Kingdom’s AI Security Institute, which was granted early access, reported that the model succeeded at expert-level hacking tasks more than two-thirds of the time. Anthropic then took the unusual step of withholding general release and instead constituted Project Glasswing, a small consortium of defenders that includes JPMorgan Chase, Microsoft, Google, Apple, Amazon Web Services and Nvidia. The implicit signal to banks across the world is unmistakable: the balance between offence and defence has shifted, and that too, abruptly.
For Indian banking, this is neither a distant concern nor a problem confined to developed-market peers. On 23rd of April, the Union Finance Minister convened a meeting of the heads of banks, along with officials from the Reserve Bank of India and MeitY, to assess Mythos-related risks to the country’s financial system, describing the risk as “unprecedented”. CERT-In followed it up by issuing a high-severity advisory that explicitly referred to the model and urged organisations to treat newly disclosed vulnerabilities as exploitable within hours rather than weeks. The National Payments Corporation of India and some of the banks have, according to public reports, sought early access to Mythos to identify vulnerabilities and ‘zero-day’ cyber risk exposure. These responses have been swift and serious, and confirm what the banking ecosystem is beginning to internalise: a model that no Indian institution can directly access may nevertheless reshape the threat landscape in which it currently operates.
