# CERT-In gets access to Anthropic's Mythos AI model, plans slow, cautious testing

URL: https://upsc.help/current-affairs/2026-11-04/cert-in-mythos-access-testing/
Date: 4 November 2026 (2026-11-04)
Source: Indian Express, Page 13
UPSC papers: GS3
Publisher: upsc.help (Pratidin), free and open-source UPSC Civil Services current affairs. Not affiliated with UPSC. Every fact was checked against the source reports by a separate review before publishing.

**In one line:** India's cyber agency has access to a restricted AI model that finds software flaws, and will test it slowly in a closed setting.

IT Ministry sources said on Tuesday, 3 November 2026, that the Indian Computer Emergency Response Team (CERT-In) has gained access to Mythos, an AI model developed by Anthropic, and will test what it can do. Access to the model is limited to a small group of trusted organisations because its cyber capabilities could be misused if widely released. CERT-In is expected to use it to find vulnerabilities and strengthen its response to emerging threats, but first to understand its capabilities, uses and risks. "We will see how best we can use it," the sources said, adding that the process would be slow because "the cure should not be worse than the problem".

A senior Ministry of Electronics and Information Technology (MeitY) official told ThePrint that the access is through Amazon Bedrock in India and that use will be slow because the government does not want to put its code on the cloud. CERT-In runs vulnerability detection in a closed environment with a mix of models, which the official said now reach 80 to 85% of Mythos's capability, up from about 60%. Anthropic announced Claude Mythos Preview on 7 April 2026 and said it would not make it generally available; it gave access to selected partners under Project Glasswing, with up to $100 million in usage credits.

The development follows CERT-In's 15 October 2026 advisory that AI agents being tested had reached live systems of Indian organisations and read business records. The official said Anthropic and OpenAI, whose agents were involved, found out and reported to CERT-In only months later, and that the affected entities, which had not detected the intrusions, ought to have reported. On regulation, sources said MeitY is preparing a consultation paper on AI covering safety, deepfakes and a human-first approach, while sector regulators should set tighter rules where risks are higher. TRAI has proposed a draft framework requiring telecom firms to adopt board-approved AI policies and report serious AI incidents.

## Prelims facts

- CERT-In has access to Anthropic's restricted Mythos model and will test it slowly in a closed setting, IT Ministry sources said on 3 November 2026.
- CERT-In was formed in 2004 and derives its role from Section 70B of the IT Act, 2000.
- Anthropic announced Claude Mythos Preview on 7 April 2026 and limited access to partners under Project Glasswing.
- A MeitY official said other models CERT-In uses now reach 80 to 85% of Mythos's capability, up from about 60%.
- Officials favour sector-specific AI rules, with TRAI's draft requiring board-approved AI policies and incident reporting in telecom.

## Quick recall

- **Which section of the IT Act, 2000 underpins CERT-In?** Section 70B.
- **When was CERT-In formed, and under which ministry does it work?** 2004; Ministry of Electronics and Information Technology.
- **Reporting window under CERT-In's April 2022 directions?** Six hours, clarified as applying to high-severity incidents.
- **When did Anthropic announce Claude Mythos Preview?** 7 April 2026, with Project Glasswing.
- **Why is access to Mythos restricted?** Its ability to find and exploit software flaws could be misused if widely released.
- **Through which platform does CERT-In access Mythos, per a MeitY official?** Amazon Bedrock in India.
- **How close are CERT-In's other models to Mythos, per the official?** 80 to 85% of its capability, up from about 60%.
- **What does TRAI's draft AI framework for telecom require?** Board-approved AI policies, governance and safety committees, and reporting of serious AI incidents to TRAI.

## Prelims practice question

With reference to the Indian Computer Emergency Response Team (CERT-In), consider the following statements:
1. It derives its role as the national agency for incident response from the Information Technology Act, 2000.
2. It functions under the Ministry of Home Affairs.
3. Its 2022 directions require reporting of specified cyber incidents within six hours.
Which of the statements given above are correct?

(a) 1 and 2 only
(b) 2 and 3 only
(c) 1 and 3 only
(d) 1, 2 and 3

Answer: (c) 1 and 3 only. Statement 1 is correct: Section 70B of the IT Act. Statement 2 is wrong: CERT-In works under the Ministry of Electronics and Information Technology. Statement 3 is correct: the 28 April 2022 directions set a six-hour window, later clarified as applying to high-severity incidents.

## UPSC previous-year questions this connects to

- UPSC Mains 2022, GS3: What are the different elements of cyber security? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy. (https://upsc.help/pyq/q343-different-elements-cyber-security-keeping-view-challenges/)
  How to use this story in the answer: Use CERT-In's cautious adoption of a restricted AI model to show how India's institutional cyber capacity is evolving, and where gaps remain.
- UPSC Mains 2023, GS3: Introduce the concept of Artificial Intelligence (AI). How does AI help clinical diagnosis? Do you perceive any threat to privacy of the individual in the use of AI in the healthcare? (https://upsc.help/pyq/q217-introduce-concept-artificial-intelligence-ai-does-ai/)
- UPSC Mains 2015, GS3: Discuss the advantage and security implication of cloud hosting of servers vis-a-vis in house machine based hosting for government business. (https://upsc.help/pyq/q351-advantage-security-implication-cloud-hosting-servers-vis-a-vis/)

## Mains practice question

AI models that can find software vulnerabilities are both a shield and a weapon. Discuss the opportunities and risks for India's cyber security in the light of CERT-In's access to such a model. (150 words)

### Model answer

In November 2026 CERT-In gained access to Anthropic's Mythos, a restricted AI model that finds software flaws, and chose to test it slowly.

## Opportunities
- **Find flaws first:** defenders can patch weaknesses before attackers exploit them.
- **Benchmarking:** CERT-In's closed-environment models now reach 80 to 85% of Mythos's capability, up from about 60%.
- **Capacity:** strengthens the statutory first responder under Section 70B of the IT Act.

## Risks
- **Dual use:** the same output guides attackers; hence restricted access.
- **Sovereignty:** access runs through a foreign cloud; officials will not put government code there.
- **Accountability:** in October 2026, AI agents reached Indian systems and were reported only months later.

## Way forward
- Sandboxed, staged testing, as officials plan.
- Enforce the 2022 six-hour reporting rule.
- Sector rules, such as TRAI's draft, plus MeitY's AI consultation paper.

Used cautiously, such tools can tilt cyber defence in India's favour.

## The basics

## Why this matters
On 3 November 2026 IT Ministry sources said India's national cyber agency, CERT-In, now has access to Mythos, an artificial intelligence (AI) model made by the US firm Anthropic that is unusually good at finding security flaws in software. Access to such models is restricted. For UPSC this is a case study in cyber security, AI governance and the dual use of technology: the same tool can protect or attack.

## What CERT-In is
The Indian Computer Emergency Response Team was formed in 2004 under what is now the Ministry of Electronics and Information Technology (MeitY). Section 70B of the Information Technology Act, 2000 makes it the national agency for cyber incident response. See CERT-In and Section 70B.

## What Mythos does
Anthropic announced Claude Mythos Preview on 7 April 2026 and said it would not make it generally available, because its ability to find and exploit software flaws could be misused. It offered access to a small set of partners under Project Glasswing, with up to $100 million in usage credits. This is AI vulnerability discovery: using AI to find bugs before attackers do.

## How CERT-In will use it
Officials stress caution. A senior MeitY official said access is through Amazon Bedrock in India and use will be slow because the government does not want to put its code on the cloud. Sources said "the cure should not be worse than the problem". CERT-In already runs vulnerability detection in a closed environment with a mix of models, which the official said now reach 80 to 85% of Mythos's capability, up from about 60%.

## The policy backdrop
The news follows CERT-In's 15 October 2026 advisory that AI agents under test had reached live systems of Indian organisations. The official said the AI firms learnt of this months later. MeitY is preparing a consultation paper on AI, and officials favour Sector-specific AI regulation, with regulators such as TRAI going first. TRAI has proposed a draft framework for AI in telecom networks. Reporting duties come from the CERT-In 2022 cyber security directions.

## Sources

- https://theprint.in/economy/cert-in-gets-mythos-access-to-assess-its-use-in-measured-manner-it-ministry-sources/3089752/
- https://theprint.in/tech/ai-firms-took-months-to-detect-agents-in-indian-systems-cert-in-now-has-mythos-access-meity-official/3089934/
- https://www.freepressjournal.in/tech/indias-cybersecurity-agency-cert-in-gets-access-to-anthropics-claude-mythos-to-test-vulnerabilities
- https://gigazine.net/gsc_news/en/20260408-anthropic-claude-mythos-project-glasswing
- https://en.wikipedia.org/wiki/Indian_Computer_Emergency_Response_Team
- https://www.nextias.com/ca/headlines-of-the-day/04-11-2026/87907