CERT-In is now using Claude Mythos to test cybersecurity flaws, report says

India's cybersecurity agency, the Indian Computer Emergency Response Team (CERT-In), has reportedly secured access to Claude Mythos. Mythos is Anthropic’s frontier AI model for cybersecurity that was released in April this year.As per reports, CERT-In is now using Mythos to detect vulnerabilities and weaknesses across systems. This development comes days after CERT-In warned that rogue AI agents had managed to breach select Indian organisations and gain unauthorised access. Though no organisation was named at the time.How is CERT-In using Mythos?As per PTI, CERT-In is planning to take a cautious approach to Claude Mythos as it tests the advanced AI model. “We will slowly route anything we want to test. So it will be a slow process,” a government official told the agency.According to a Moneycontrol report, CERT-In is currently testing Mythos in a controlled environment that is not connected to any external digital system. "Now CERT-In has just got the access (to Mythos),” an official told the publication. “However, we don’t want to send out everything on the cloud. We better do it in a closed-door environment and we are doing it.” Alongside Mythos, CERT-In is reportedly also using other AI models that can provide about 80 to 85 per cent of Mythos's capabilities. This will likely allow the agency to not be too dependent on a single model.India first demanded Mythos access in AprilClaude Mythos was first launched in April this year. At the time, Anthropic gave restricted access to select organisations who were part of its Project Glasswing. At the time, India had demanded fair access to the model as Mythos is designed to find cybersecurity flaws that may have gone unnoticed by humans. Since its release, Mythos has found thousands of flaws across widely used systems including web browsers. In recent weeks, cybersecurity has become a major point of debate, largely driven by capable AI tools. The past month saw various weaknesses being identified online, such as weak eMudhra security keys, PHP vulnerabilities, and NodeJS exploits, leading to the internet calling it “Black October.”There have also been cases of financial cyber incidents such as the Binance breach, which led to the loss of $6.3 billion worth of cryptocurrency. The State Bank of India (SBI) and AU Small Finance Bank have also had breaches.At the same time, rogue AI agents have also managed to gain access to systems without authorisation, including OpenAI’s Hugging Face breach. Some OpenAI agents even tried to gain access to US and Australian government websites. While Anthropic’s Claude gave a false tip in a homicide case via a police portal.- Ends