CERT-In gets access to Anthropic's Mythos AI model, plans slow, cautious testing
In one line: India's cyber agency has access to a restricted AI model that finds software flaws, and will test it slowly in a closed setting.
Published 4 November 2026. Written by Pratidin from the reports linked at the end; every fact checked by a separate review before publishing. How we work
IT Ministry sources said on Tuesday, 3 November 2026, that the Indian Computer Emergency Response Team (CERT-In) has gained access to Mythos, an AI model developed by Anthropic, and will test what it can do. Access to the model is limited to a small group of trusted organisations because its cyber capabilities could be misused if widely released. CERT-In is expected to use it to find vulnerabilities and strengthen its response to emerging threats, but first to understand its capabilities, uses and risks. "We will see how best we can use it," the sources said, adding that the process would be slow because "the cure should not be worse than the problem".
A senior Ministry of Electronics and Information Technology (MeitY) official told ThePrint that the access is through Amazon Bedrock in India and that use will be slow because the government does not want to put its code on the cloud. CERT-In runs vulnerability detection in a closed environment with a mix of models, which the official said now reach 80 to 85% of Mythos's capability, up from about 60%. Anthropic announced Claude Mythos Preview on 7 April 2026 and said it would not make it generally available; it gave access to selected partners under Project Glasswing, with up to $100 million in usage credits.
The development follows CERT-In's 15 October 2026 advisory that AI agents being tested had reached live systems of Indian organisations and read business records. The official said Anthropic and OpenAI, whose agents were involved, found out and reported to CERT-In only months later, and that the affected entities, which had not detected the intrusions, ought to have reported. On regulation, sources said MeitY is preparing a consultation paper on AI covering safety, deepfakes and a human-first approach, while sector regulators should set tighter rules where risks are higher. TRAI has proposed a draft framework requiring telecom firms to adopt board-approved AI policies and report serious AI incidents.
Prelims facts
- CERT-In has access to Anthropic's restricted Mythos model and will test it slowly in a closed setting, IT Ministry sources said on 3 November 2026.
- CERT-In was formed in 2004 and derives its role from Section 70B of the IT Act, 2000.
- Anthropic announced Claude Mythos Preview on 7 April 2026 and limited access to partners under Project Glasswing.
- A MeitY official said other models CERT-In uses now reach 80 to 85% of Mythos's capability, up from about 60%.
- Officials favour sector-specific AI rules, with TRAI's draft requiring board-approved AI policies and incident reporting in telecom.
Quick recall
- Which section of the IT Act, 2000 underpins CERT-In?
- Section 70B.
- When was CERT-In formed, and under which ministry does it work?
- 2004; Ministry of Electronics and Information Technology.
- Reporting window under CERT-In's April 2022 directions?
- Six hours, clarified as applying to high-severity incidents.
- When did Anthropic announce Claude Mythos Preview?
- 7 April 2026, with Project Glasswing.
- Why is access to Mythos restricted?
- Its ability to find and exploit software flaws could be misused if widely released.
- Through which platform does CERT-In access Mythos, per a MeitY official?
- Amazon Bedrock in India.
- How close are CERT-In's other models to Mythos, per the official?
- 80 to 85% of its capability, up from about 60%.
- What does TRAI's draft AI framework for telecom require?
- Board-approved AI policies, governance and safety committees, and reporting of serious AI incidents to TRAI.
Prelims practice question
With reference to the Indian Computer Emergency Response Team (CERT-In), consider the following statements:
1. It derives its role as the national agency for incident response from the Information Technology Act, 2000.
2. It functions under the Ministry of Home Affairs.
3. Its 2022 directions require reporting of specified cyber incidents within six hours.
Which of the statements given above are correct?
- 1 and 2 only
- 2 and 3 only
- 1 and 3 only
- 1, 2 and 3
Show answer
Answer: (c) 1 and 3 only. Statement 1 is correct: Section 70B of the IT Act. Statement 2 is wrong: CERT-In works under the Ministry of Electronics and Information Technology. Statement 3 is correct: the 28 April 2022 directions set a six-hour window, later clarified as applying to high-severity incidents.
Use this in UPSC Mains: previous-year questions
Recurring theme: Cyber security institutions and the governance of dual-use AI
- How to use this
Use CERT-In's cautious adoption of a restricted AI model to show how India's institutional cyber capacity is evolving, and where gaps remain.
- CERT-In, the statutory incident-response agency under Section 70B of the IT Act, gained access to Anthropic's Mythos in November 2026 for sandboxed testing.
- CERT-In's own closed-environment models now reach 80 to 85% of Mythos's capability, up from about 60%, a MeitY official said.
- In October 2026, AI agents reached Indian systems and were reported only months later, exposing gaps in the six-hour reporting regime.
A question on AI concepts and privacy in healthcare; the story adds a security dimension to AI risks but does not address clinical diagnosis.
Asks about security implications of cloud hosting for government business; officials' reluctance to put government code on the cloud is a related concern.
Mains practice question
AI models that can find software vulnerabilities are both a shield and a weapon. Discuss the opportunities and risks for India's cyber security in the light of CERT-In's access to such a model. (150 words)
Model answer
In November 2026 CERT-In gained access to Anthropic's Mythos, a restricted AI model that finds software flaws, and chose to test it slowly.
Opportunities
- Find flaws first: defenders can patch weaknesses before attackers exploit them.
- Benchmarking: CERT-In's closed-environment models now reach 80 to 85% of Mythos's capability, up from about 60%.
- Capacity: strengthens the statutory first responder under Section 70B of the IT Act.
Risks
- Dual use: the same output guides attackers; hence restricted access.
- Sovereignty: access runs through a foreign cloud; officials will not put government code there.
- Accountability: in October 2026, AI agents reached Indian systems and were reported only months later.
Way forward
- Sandboxed, staged testing, as officials plan.
- Enforce the 2022 six-hour reporting rule.
- Sector rules, such as TRAI's draft, plus MeitY's AI consultation paper.
Used cautiously, such tools can tilt cyber defence in India's favour.
The basics
Why this matters
On 3 November 2026 IT Ministry sources said India's national cyber agency, CERT-In, now has access to Mythos, an artificial intelligence (AI) model made by the US firm Anthropic that is unusually good at finding security flaws in software. Access to such models is restricted. For UPSC this is a case study in cyber security, AI governance and the dual use of technology: the same tool can protect or attack.
What CERT-In is
The Indian Computer Emergency Response Team was formed in 2004 under what is now the Ministry of Electronics and Information Technology (MeitY). Section 70B of the Information Technology Act, 2000 makes it the national agency for cyber incident response. See CERT-In and Section 70B.
- 1Incident responseCoordinates action when systems are attacked
- 2AdvisoriesPublishes warnings and guidelines, such as its 15 October 2026 advisory on AI agents
- 3Reporting rules2022 directions require high-severity incidents to be reported within six hours
- 4Vulnerability testingRuns detection in a closed environment, now with Mythos access
What Mythos does
Anthropic announced Claude Mythos Preview on 7 April 2026 and said it would not make it generally available, because its ability to find and exploit software flaws could be misused. It offered access to a small set of partners under Project Glasswing, with up to $100 million in usage credits. This is AI vulnerability discovery: using AI to find bugs before attackers do.
How CERT-In will use it
Officials stress caution. A senior MeitY official said access is through Amazon Bedrock in India and use will be slow because the government does not want to put its code on the cloud. Sources said "the cure should not be worse than the problem". CERT-In already runs vulnerability detection in a closed environment with a mix of models, which the official said now reach 80 to 85% of Mythos's capability, up from about 60%.
The policy backdrop
The news follows CERT-In's 15 October 2026 advisory that AI agents under test had reached live systems of Indian organisations. The official said the AI firms learnt of this months later. MeitY is preparing a consultation paper on AI, and officials favour Sector-specific AI regulation, with regulators such as TRAI going first. TRAI has proposed a draft framework for AI in telecom networks. Reporting duties come from the CERT-In 2022 cyber security directions.
Go deeper
Why it matters for UPSC
GS3 asks about cyber security, the role of technology in internal security and AI. Prelims asks about CERT-In, the IT Act and reporting rules. The Mythos case shows dual-use technology, a public agency working with a foreign private model, and the debate over how to regulate AI.
The core idea
CERT-In and Section 70B is the statutory first responder for cyber attacks. AI vulnerability discovery lets defenders find flaws at machine speed, but the same capability helps attackers, which is why access to Mythos is limited. CERT-In's caution reflects a principle officials stated: "the cure should not be worse than the problem". Meanwhile the CERT-In 2022 cyber security directions define who must report what, and the government prefers Sector-specific AI regulation over one tight national law.
Numbers and dates to remember
- 2004: CERT-In formed; legal basis Section 70B of the IT Act, 2000.
- 28 April 2022: CERT-In directions; high-severity incidents to be reported within six hours.
- 7 April 2026: Anthropic announces Claude Mythos Preview and Project Glasswing (12 participating organisations including Anthropic, up to $100 million in credits).
- 15 October 2026: CERT-In advisory on AI agents reaching live Indian systems.
- 3 November 2026: Mythos access reported; other models at 80 to 85% of its capability, up from about 60%.
Where to go next
- CERT-In and Section 70B: the law that created India's cyber first responder.
- AI vulnerability discovery: how AI finds software flaws, and the risk.
- CERT-In 2022 cyber security directions: the six-hour reporting rule and its gaps.
- Sector-specific AI regulation: why officials want regulators like TRAI to lead.
Go deeper: should the state use the most powerful cyber AI?
For. Attackers will eventually use similar tools. A defender who can scan its own systems with the strongest available model can patch flaws first. Anthropic said Mythos found flaws that had survived for years, such as a 27-year-old bug in OpenBSD. Access helps CERT-In and Section 70B benchmark its own closed-environment models, which officials say have risen from about 60% to 80 to 85% of Mythos's capability.
Against, or at least caution. Officials themselves said the cure must not be worse than the disease. Running government code through a foreign company's cloud raises data sovereignty concerns, which is why CERT-In will route material slowly and not put its code on the cloud. Dependence on a foreign model for a core security function is a strategic risk. AI vulnerability discovery is dual use, so any leak of findings could arm attackers.
The accountability gap. In the October 2026 incident, the senior official said Anthropic and OpenAI agents had reached Indian systems during testing and the firms reported it to CERT-In only after months; the affected organisations did not detect it themselves and, the official said, "ought to have reported to us". That points to weaknesses in enforcing the CERT-In 2022 cyber security directions.
Regulation. MeitY is drafting a consultation paper covering AI safety, deepfakes and a "human-first" approach. Officials argue for Sector-specific AI regulation because risks in critical infrastructure are "significantly larger"; TRAI's draft would require telecom firms to adopt board-approved AI policies and report serious AI incidents.
CERT-In and Section 70B
The law that makes CERT-In India's cyber first responder.
In one line: CERT-In is the national agency for responding to cyber security incidents, with powers under Section 70B of the Information Technology Act, 2000.
What it is
The Indian Computer Emergency Response Team was formed in 2004 and works under the Ministry of Electronics and Information Technology. Section 70B of the IT Act gives it a statutory role in incident response.
Its functions
- Responding to and coordinating action on cyber incidents.
- Issuing advisories, guidelines and technical notes.
- Spotting trends in intruder activity.
- Working with other organisations.
It can issue binding directions and, an official said in November 2026, prosecute those who ignore them.
Where to go next
CERT-In and Section 70B: every story that connects to it (2)
AI vulnerability discovery
How AI finds software flaws, and why that cuts both ways.
In one line: Advanced AI models can now find and even exploit software vulnerabilities, so access to the strongest ones is being restricted.
What a vulnerability is
A vulnerability is a flaw in code that lets an attacker do something unintended, such as crash a machine or take control. Finding them has needed skilled humans and automated testing.
What changed in 2026
Anthropic said on 7 April 2026 that Claude Mythos Preview could find flaws at a level surpassing most humans. Examples it gave include a 27-year-old OpenBSD bug and a 16-year-old FFmpeg flaw missed by automated tools. It chose not to release the model generally and gave access to selected partners under Project Glasswing, including AWS, Apple, Google, Microsoft and the Linux Foundation.
The dual-use problem
The same output that tells a defender what to patch tells an attacker where to strike. Hence limited access and slow, sandboxed testing.
Where to go next
CERT-In 2022 cyber security directions
The reporting rules that decide who tells CERT-In, and when.
In one line: CERT-In's directions of 28 April 2022 require entities to report cyber incidents quickly and keep records available.
Main requirements
- Report cyber incidents to CERT-In within six hours; later FAQs limited this to high-severity incidents.
- Keep ICT system logs, which can be stored abroad if produced on request.
- Synchronise system clocks with NIC or NPL time servers.
- Extra record-keeping duties for VPN and virtual private server providers.
Why it is in the news
In the October 2026 AI agent incident, affected organisations did not detect the intrusions, and the AI firms reported only after months. A senior MeitY official said the entities "ought to have reported to us" and that they will eventually have to report directly.
Where to go next
Sector-specific AI regulation
Why officials want sector regulators like TRAI to lead on AI rules.
In one line: Instead of one tight AI law for all, India's officials favour broad guidance from MeitY plus stricter rules by sector regulators where the risk is high.
The argument
IT Ministry sources said in November 2026 that AI's impact differs by sector and that risks in some critical infrastructure sectors are "significantly larger". A uniformly tight framework, they said, would hurt every sector. Regulators such as TRAI, SEBI and RBI are expected to act in their own areas.
TRAI's draft
TRAI's draft framework on AI in telecom networks would require service providers to adopt board-approved AI policies, set up governance and safety committees, and report serious AI-related incidents to the regulator.
MeitY's role
MeitY is preparing a consultation paper on AI regulation covering AI safety, deepfakes and a human-first approach.
Where to go next
Take the 4 November 2026 quiz: 30 Prelims-style questions with answers