समाचार Samāchār · Tech & AI · 4 November 2026

CERT-In gets access to Anthropic’s Mythos. It will test slowly

India’s cyber emergency team can now use the model that finds software flaws at scale. IT Ministry sources say every test will be routed with care because the cure should not be worse than the problem.

CERT-In, India’s national computer emergency response team, now has access to Mythos, Anthropic’s restricted model for finding software vulnerabilities. IT Ministry sources told PTI on Tuesday that the team will start by learning what the model can do, where it can help and what risks it brings before any wider use. The Economic Times reported the same officials as being careful with testing.

The caution is deliberate. The sources said anything CERT-In wants to test will be routed slowly, and that the cure should not be worse than the problem. No official was named and the terms of access were not disclosed.

Mythos is not on general sale. Anthropic disclosed it in April and limited it to a consortium called Project Glasswing because its ability to find flaws in critical software could be misused. The group grew to about 200 organisations in May across power, water, healthcare, communications and hardware. Anthropic says its first 50 partners found more than 10,000 high or critical vulnerabilities. Independent researchers have questioned some headline claims, and one count in September found that only about a tenth of the flaws had been disclosed and under 1% fixed.

India has been preparing since April, when the Finance Minister met banks and officials on the risk. The same sources said the IT Ministry is drafting a consultation paper on AI regulation covering safety and deepfakes, while TRAI has proposed a separate framework for AI in telecom networks. Sectoral regulators can set tighter rules for critical infrastructure, they said, without one uniform rule for every sector.

What a founder takes from it: Access is the easy part. Finding flaws is now cheap and fixing them is not. India’s test should be measured by how fast UPI, Aadhaar, banks, power and telecom close what the model finds, so a public patch timeline matters more than the model.