Anthropic’s Mythos AI Model: How Artificial Intelligence Is Transforming Cybersecurity

The Indian Computer Emergency Response Team (CERT-In) has gained access to Anthropic’s advanced artificial intelligence model, Claude Mythos Preview, to assess its ability to identify software vulnerabilities. The agency is conducting small-scale, controlled experiments to understand how the technology can support cybersecurity and protect critical digital infrastructure.

Developed by US-based AI company Anthropic, Mythos is a general-purpose AI model with advanced coding, reasoning and agentic capabilities. Its ability to analyse complex software systems allows it to detect previously unknown security weaknesses, including zero-day vulnerabilities. These are software flaws that developers are unaware of or have not yet fixed, making them particularly dangerous for digital systems.

The model can also help researchers reproduce vulnerabilities, understand how attackers could exploit them and develop security fixes. However, Anthropic has restricted public access because the same capabilities could be misused by cybercriminals and malicious state actors.

AI presents a dual challenge for cybersecurity. While it can strengthen defence mechanisms, it can also enable faster and more sophisticated cyberattacks through malicious code, targeted phishing messages and deepfake-based impersonation.

Project Glasswing and CERT-In’s Efforts to Address AI-Enabled Cyber Threats

Anthropic launched Project Glasswing on April 7, 2026, to strengthen the security of critical software infrastructure using advanced AI. The initiative provides selected organisations with restricted access to Mythos to identify and fix vulnerabilities before attackers exploit them. Major participants include Microsoft, Google, Amazon Web Services, Apple, Cisco and CrowdStrike. Anthropic has committed up to $100 million in model usage credits and $4 million in donations for open-source security efforts.

India’s participation includes CERT-In, the Indian Cyber Crime Coordination Centre (I4C), the National Critical Information Infrastructure Protection Centre (NCIIPC) and the Department of Telecommunications’ Digital Intelligence Platform.

CERT-In, established in January 2004 under the Ministry of Electronics and Information Technology, functions under Section 70B of the Information Technology Act, 2000. It coordinates responses to cybersecurity incidents and disseminates information about emerging threats.

To address AI-related risks, CERT-In has introduced an AI systems auditing framework, classifying systems into four risk categories: low, moderate, high and critical. It also requires reportable AI-related cybersecurity incidents to be disclosed within six hours and security logs to be retained for at least 180 days.

Its recommendations include multi-factor authentication, privileged access management, network micro-segmentation and software supply chain security to strengthen India's preparedness against increasingly sophisticated cyber threats.