CERT-In Mythos AI access to support cautious cyber vulnerability testing, sources say

India’s cybersecurity agency CERT-In has secured access to Anthropic’s Mythos AI model, IT Ministry sources said on Tuesday. The agency is set to begin using the tool while keeping checks in place. Sources said the plan is to test the model in stages. The aim is to judge safe uses for cyber defence work.

Representative image

Mythos is limited to a small circle of trusted organisations. Officials cited worries that its cyber features could be misused at scale. CERT-In is expected to study how the model behaves before expanding its use. Access could support work on finding weaknesses in systems. It could also help improve responses to new threats.

CERT-In Mythos AI model access and cautious testing

Sources said CERT-In will start by running controlled trials and learning from results. "We will see how best we can use it,\" the sources said. Officials described the pace as deliberately measured. \"We will slowly route anything we want to test. So it will be a slow process,\" they said. The focus is on safety during early experiments.

Sources said the approach is meant to prevent harm while seeking benefits. They said the guiding thought is \"the whole idea is that the cure should not be worse than the problem.\" Officials expect a careful review of the model’s strengths and limits. The agency will also weigh risks tied to possible misuse. Wider use will depend on early findings.

AI cybersecurity risks and sector-specific rules backed by MeitY

The move comes as debate grows over AI in cybersecurity. Advanced models can help detect vulnerabilities and suggest fixes. The same skills can also be used by attackers. Sources said such dual-use risks require restraint and clear controls. They indicated that careful testing is needed before relying on such tools widely.

Sources also commented on the Telecom Regulatory Authority of India’s draft on responsible AI use in telecom. They said sector-focused rules make sense because AI affects fields differently. \"Risks from AI are significantly larger in some critical infrastructure sectors,\" the sources said. Officials said regulators like TRAI and others should lead such sectoral guidance.

TRAI, last week, issued a draft framework for responsible AI use in telecom networks. It proposed that service providers adopt board-approved AI policies. It also suggested dedicated governance and safety committees. The draft said serious AI-related incidents should be reported to the regulator. The framework aimed to set common checks for telecom AI systems.

Alongside this, the IT Ministry is preparing a consultation paper on AI regulation. Sources said it will address AI safety, deepfakes, and a human-first approach. Officials added that the ministry works closely with regulators in high-risk fields. They said some areas are critical infrastructure and need tighter rules. The goal is to match controls to sector risks.

Officials warned that one strict rulebook for all sectors could create wider burdens. \"MeitY IT Ministry will do it...but problem with an overarching MeitY guidance is that it affects different sectors differently. I think sectoral regulators should also go ahead... the risks which affect some of the sectors are significantly higher, and they are also critical infrastructure sectors, so we work closely with them regulators. You can be a little tight in some of those sectors, but if MeitY gets tight, it affects everyone,\" the sources said.

CERT-In’s access to Anthropic’s Mythos is expected to be used first for limited trials. Officials said the process will remain slow and risk-aware. At the same time, the IT Ministry and regulators like TRAI are moving towards clearer AI safeguards. The approach, sources said, is to tailor rules by sector. This reflects different risk levels across critical systems.

With inputs from PTI