India's CERT-In Gets Access to Anthropic's Mythos Model for Cybersecurity Work

CERT-In will first work out what the model can do, where it could be used and what risks it carries before any wider use, according to the PTI report carried by ThePrint. The sources said the agency would "slowly route anything we want to test" to the model and described the process as deliberately slow. "The cure should not be worse than the problem," they said, adding: "We will see how best we can use it."

The agency expects Mythos to help it find cyber vulnerabilities and respond better to new threats, the report said.

A Restricted Model

Anthropic has made Mythos available only to "a small group of trusted organisations," according to the report, because of concerns that its cyber capabilities could be misused if released widely. The government has spent months pursuing access for national bodies. Indian outlets earlier this year reported that some organisations in cybersecurity, telecoms, banking and finance had received early access, and an IT secretary was quoted describing preparatory work as a "dry run" so that systems would be ready once the model became available.

Neither Anthropic nor the Indian government has publicly confirmed the details of the arrangement. The account comes from unnamed ministry sources.

India's Wider AI Rulebook

The news comes as Indian regulators set out their approach to AI governance. Last week the Telecom Regulatory Authority of India proposed a draft framework for responsible AI use in telecom networks, ThePrint reported. It would require operators to adopt board-approved AI policies, set up governance and safety committees, and report serious AI-related incidents to the regulator.

The IT Ministry is preparing a consultation paper on AI regulation covering AI safety, deepfakes and what the sources called a "human-first approach." The sources said sector regulators should lead on guidelines because AI risks differ from one sector to another and are much higher in critical infrastructure, where tighter rules may be justified. "If MeitY gets tight, it affects everyone," they said, referring to the IT Ministry.

Why It Matters

Models with strong offensive and defensive cyber capabilities are being handed out under controlled access rather than released openly. Whether a government agency gets access is becoming a question of national security policy as much as procurement. Governments that cannot use these models risk falling behind attackers who might eventually get similar tools, while those that do gain access must manage the risk of relying on a foreign provider's system for sensitive security work.

India's approach is to start slowly with a narrow set of test cases. It also leaves detailed AI rules to sector regulators rather than a single horizontal law, an approach that ministers in other countries, including the UK, have argued for. Gulf governments are also seeking access to frontier security tools, and India's case shows the kind of graduated, test-first terms they may face.