16
The Reserve Bank of India (RBI) is examining the potential cybersecurity risks posed by Anthropic’s advanced AI model Mythos, amid growing concerns among financial regulators
about the ability of frontier AI systems to identify and exploit software vulnerabilities.
The central bank has been consulting global regulators, Indian banks and government officials as it assesses how the technology could affect the country’s financial infrastructure. According to people familiar with the matter, the RBI has also discussed the issue with counterparts at the US Federal Reserve and the Bank of England.
Anthropic introduced Mythos in April through a controlled programme rather than making it widely available. The company has described the model as highly capable in cybersecurity tasks, including finding vulnerabilities in software. Its capabilities have raised concerns that similar technology could also be misused by attackers.
The RBI’s review comes as regulators in several countries ask banks to strengthen their cyber defences against the emerging risks associated with advanced AI. The concern is not limited to conventional hacking. More capable AI systems could potentially speed up parts of the process used to identify weaknesses in software and digital networks.
India’s National Payments Corporation of India (NPCI) was also seeking early access to Mythos to study potential “day-zero” vulnerabilities and assess how the technology could affect payment infrastructure. However, access to the model was subject to restrictions because it was being operated through controlled servers in the United States.
The RBI was also considering broader safeguards for banks and other financial institutions using advanced AI systems. Data security and compliance with India’s data-localisation requirements were among the issues being examined.
The development highlights a new challenge for financial institutions: AI can strengthen cybersecurity by helping organisations identify weaknesses, but the same capabilities could potentially be used against them.
India’s financial sector is therefore facing the task of preparing for a technology that could become both a defensive tool and a new source of cyber risk.
The central bank has been consulting global regulators, Indian banks and government officials as it assesses how the technology could affect the country’s financial infrastructure. According to people familiar with the matter, the RBI has also discussed the issue with counterparts at the US Federal Reserve and the Bank of England.
Anthropic introduced Mythos in April through a controlled programme rather than making it widely available. The company has described the model as highly capable in cybersecurity tasks, including finding vulnerabilities in software. Its capabilities have raised concerns that similar technology could also be misused by attackers.
The RBI’s review comes as regulators in several countries ask banks to strengthen their cyber defences against the emerging risks associated with advanced AI. The concern is not limited to conventional hacking. More capable AI systems could potentially speed up parts of the process used to identify weaknesses in software and digital networks.
India’s National Payments Corporation of India (NPCI) was also seeking early access to Mythos to study potential “day-zero” vulnerabilities and assess how the technology could affect payment infrastructure. However, access to the model was subject to restrictions because it was being operated through controlled servers in the United States.
The RBI was also considering broader safeguards for banks and other financial institutions using advanced AI systems. Data security and compliance with India’s data-localisation requirements were among the issues being examined.
The development highlights a new challenge for financial institutions: AI can strengthen cybersecurity by helping organisations identify weaknesses, but the same capabilities could potentially be used against them.
India’s financial sector is therefore facing the task of preparing for a technology that could become both a defensive tool and a new source of cyber risk.
