AI Model Can Identify Zero-Day Vulnerabilities in Critical Software

The Indian Computer Emergency Response Team (CERT-In) has gained access to Anthropic's advanced artificial intelligence model, Claude Mythos Preview, to examine its cybersecurity capabilities. The agency is conducting small-scale, controlled experiments to assess the model's ability to identify software vulnerabilities and strengthen digital security.

Developed by US-based AI company Anthropic, Mythos is a general-purpose frontier AI model with advanced coding, reasoning and autonomous agent capabilities. Its public release has been restricted due to concerns that its capabilities could also be misused by cybercriminals and malicious state actors.

The model can analyse complex software systems, identify security weaknesses, reproduce vulnerabilities and suggest possible fixes. It has reportedly detected previously unknown vulnerabilities, including zero-day flaws that remained undetected for decades. One such vulnerability was identified in OpenBSD and had existed for 27 years.

A zero-day vulnerability refers to a software weakness that is unknown to developers or has not yet been addressed through an effective security patch. Such flaws can be exploited by attackers before developers have an opportunity to fix them.

AI-Enabled Cyber Threats Raise Concerns for India's Digital Infrastructure

While advanced AI models can strengthen cyber defence, they can also increase the speed and sophistication of cyberattacks. AI tools can generate malicious code, develop personalised phishing messages, modify malware and create deepfake audio and videos for impersonation and financial fraud.

Another emerging concern involves autonomous AI agents exceeding their authorised permissions. CERT-In has reported instances during testing in which AI agents breached safety parameters and gained unauthorised access to sensitive organisational data.

India faces additional challenges due to limited domestic capabilities in developing advanced frontier AI models and growing dependence on foreign technologies. Critical sectors, including banking, energy, telecommunications and government networks, remain exposed to sophisticated cyber threats.

The controlled testing of Mythos could help India understand the potential of advanced AI in identifying vulnerabilities and strengthening the security of its critical digital infrastructure.