India's Cybersecurity Agency CERT-In Gets Access To Anthropic's Claude Mythos To Test Vulnerabilities

India's cybersecurity agency CERT-In has gained access to Anthropic's Mythos AI model and will begin using its capabilities, adopting a cautious and calibrated approach to assess how best it can be utilised, IT Ministry sources said on Tuesday.

Asked how the agency is going about the access, and whether it will take a more cautious approach, the sources said CERT-In will start using and experimenting with the model.

"We will see how best we can use it," the sources said, adding that the process will be slow.

"We will slowly route anything we want to test. So it will be a slow process," they said, adding that the whole idea is that "the cure should not be worse than the problem."

Mythos is available only to a small group of trusted organisations, given concerns that its cyber capabilities could be misused if released widely.

Access to Mythos is expected to allow CERT-In to leverage the model's capabilities in identifying cyber vulnerabilities and strengthening its response to emerging cyber threats.

The agency's approach, however, will be guided by caution, with the focus initially on understanding the model's capabilities, potential applications and associated risks before considering wider usage.

The development comes amid growing concerns over the use of advanced AI models in cybersecurity, where the same capabilities that help identify and address vulnerabilities could also be exploited by malicious actors to launch sophisticated cyberattacks.

Meanwhile, on the Telecom Regulatory Authority of India (TRAI's) recent move to release draft guidelines on responsible use of artificial intelligence for telecommunications, sources said that sector-specific norms are fine, as AI's impact varies by sector.

Risks from AI are significantly larger in some critical infrastructure sectors, the sources said,, backing regulators like TRAI and others to take the lead on sectoral guidelines.

TRAI, last week, proposed a comprehensive draft framework for the responsible use of artificial intelligence in telecom networks that would require service providers to adopt board-approved AI policies, establish dedicated governance and safety committees, and report serious AI-related incidents to the regulator.

At the same time, the IT Ministry too is in the process of releasing a consultation paper on AI regulations focusing on key aspects such as AI safety, deepfakes, and a human-first approach.

The IT Ministry sources said that some sectors face significantly larger risks and are critical infrastructure, so the ministry works closely with their regulators.

The sources further said that rules can be somewhat tighter in these difficult sectors. A uniformly tight framework, however, would affect everyone.

"MeitY (IT Ministry) will do it...but problem with an overarching MeitY guidance is that it affects different sectors differently. I think sectoral regulators should also go ahead... the risks which affect some of the sectors are significantly higher, and they are also critical infrastructure sectors, so we work closely with them (regulators). You can be a little tight in some of those sectors, but if MeitY gets tight, it affects everyone," the sources said.