India warns of cyber risks as Anthropic AI speeds attacks

Anthropic’s Mythos AI is compressing the gap between finding software flaws and exploiting them, prompting India’s cybersecurity agency to issue a high-severity advisory.

The agency said can turn bugs into attacks in minutes while many Indian firms take 60 to 90 days to patch systems.

Palo Alto Networks’ Unit 42 and Check Point said Mythos found tens of thousands of vulnerabilities versus about 500 in Anthropic’s earlier Opus 4.6 model.

It breached defences on the first try in 83 of 100 cases.

No Indian companies were in the program, and Nasscom has asked Anthropic to include them.

The Ministry of Electronics and Information Technology is reportedly discussing early access amid concerns over risks to banking, telecom, power, and rail systems.

🔗 Source: The Economic Times

🧠 Food for thought

Implications, context, and why it matters.

Why tech rivals are teaming up around an AI that can find software flaws and help exploit them

Anthropic’s Project Glasswing brings together Amazon Web Services, Apple, Google, Microsoft, and other companies 1.
The group centers on Claude Mythos Preview, an unreleased model that Anthropic says can spot software vulnerabilities and sometimes build exploits for them at high speed and scale 1.
Anthropic says the model found bugs that escaped decades of human review and millions of automated security checks 1.
In one case, Mythos Preview found a 27-year-old flaw in OpenBSD, an open-source operating system built with security in mind. Anthropic reported it to the maintainers, and the bug is now patched 1.
That mix of discovery and exploitation has led some observers to treat Project Glasswing and Mythos as urgent 2.

AI could make finding bugs cheaper while leaving fixes as the hard part

Some analysts argue Mythos could upend security pricing by making bug discovery far less scarce. Traditional penetration tests often cost US$20,000 to US$120,000 2.
That would move the pressure to remediation work such as ranking issues, fixing them safely, and rolling out patches at scale. The strain could hit open-source projects run by small volunteer teams hardest 2.
Forrester, a research and advisory firm, argues the Common Vulnerabilities and Exposures (CVE) system could buckle under the volume 2. CVE is a widely used catalog of public software flaws. The strain could appear as months-long enrichment backlogs 2.
Some analysts also expect nation-state cyber strategy to shift from stockpiling zero-days, previously unknown software flaws, to racing to use them before rivals do 2.