Anthropic’s Mythos has triggered fresh anxiety across the cybersecurity industry. From banks to regulators, organisations worldwide are scrambling to prepare for a new era of AI-driven cyber threats.
On May 25, India’s cybersecurity agency CERT-In urged organisations to patch vulnerabilities in critical systems within 12 hours of detection, wherever feasible, to protect infrastructure from malicious cyberattacks.
“The rapid advancement and accessibility of AI, including generative AI, large language models, autonomous agents, and AI-enabled automation platforms, are significantly transforming the cybersecurity landscape,” CERT-In said in the blueprint it released.
The urgency follows Anthropic’s recent blog post claiming that Mythos, developed under Project Glasswing, identified more than 10,000 critical vulnerabilities in just a month. According to the company, Glasswing helps the most systemically important cyber defenders gain an asymmetric advantage.
“There is an urgent need for as many organisations as possible to shore up their cyber defences. We hope that our generally available models, and the new tools, resources, and research we’re providing to accompany them, will support those organisations in improving their cybersecurity posture,” it explains.
Anthropic adds that it plans to expand Project Glasswing by working with critical partners, including the US government and allied nations.
“In the near future, once we’ve developed the far stronger safeguards we need, we look forward to making Mythos-class models available through a general release.”
Meanwhile, some of the world’s biggest banks and regulators are trying to better understand the risks posed by Mythos. Institutions including Goldman Sachs, Barclays, Deutsche Bank, and several large US banks are seeking access to the model to test their cybersecurity defences against AI-assisted attacks.
Indian regulators and banks have also begun preparing for the potential fallout. The Reserve Bank of India has reportedly held consultations with banks and global regulators, while the National Payments Corporation of India (NPCI), along with a small group of lenders, is seeking early access to the model for defensive testing.
Earlier in April, Finance Minister Nirmala Sitharaman held a high-level meeting with bank chiefs and regulators, asking lenders to strengthen cyber defences and improve their ability to respond to AI-driven threats at scale.
“We need something far more versatile to be able to counter the newer threats which are likely to come,” Sitharaman said.
Notably, Punjab National Bank recently increased its cybersecurity spending by more than 50% amid growing concerns around Mythos. The bank has allocated nearly 20% of its technology budget—around ₹700 crore to ₹800 crore—towards cybersecurity for the current financial year.
According to Gartner, preemptive cybersecurity solutions will account for 50% of IT security spending by 2030, up from less than 5% in 2024.
Banks Must Stay Ready
Speaking exclusively to AIM on the sidelines of Agentforce World Tour Mumbai 2026, Arundhati Bhattacharya, President and CEO of Salesforce South Asia, says the issue extends beyond banks and technology firms. Organisations across sectors, she said, must be prepared to respond quickly to the risks and opportunities created by Mythos.
“It is a matter for all organisations to think about how quickly they will have the ability to patch for any vulnerability that gets detected,” she says.
Bhattacharya adds that while Mythos is the immediate concern, other companies are likely to develop equally powerful models in the near future. On the debate around Mythos access, Bhattacharya argued that preparedness and rapid response capabilities will matter more than access itself.
“The ability to be agile, the ability to understand what is happening or what is a threat in the near future, or what is an opportunity in the near future—all of these will have to be things that management of any organisation anywhere will have to be constantly looking out for,” she explains.
Dr Srinivas Padmanabhuni, CTO of AiEnsured, tells AIM that the company’s public sector banks still run on legacy core banking infrastructure that was never designed to withstand this kind of adversarial pressure.
“A single AI-assisted breach at this layer does not stay contained. It can cascade across UPI, RTGS, and NEFT simultaneously, with potential systemic consequences for financial stability,” he says.
Similarly, Pavan Duggal, a Supreme Court advocate specialising in cyberlaw, cybercrime and cybersecurity, previously told AIM that India’s current legal architecture is insufficient to address AI-powered cybersecurity threats, stressing the need for a comprehensive national cybersecurity strategy.
Duggal pointed out that while governments have traditionally focused on threats from state and non-state actors, autonomous AI systems introduce a fundamentally different category of risk.
Padmanabhuni says Indian financial institutions are still operating on patch cycles and manual threat-detection processes built for an entirely different era of attacks. He opines that these systems cannot keep pace against the “vulnerability tsunami” generated by systems like Mythos.
Meanwhile, Cloudflare, a participant in Anthropic’s Project Glasswing initiative, recently warned in a blog post that Mythos can combine multiple low-severity vulnerabilities into larger exploit chains, something that traditionally required highly skilled security researchers.
“For instance, it might turn a use-after-free bug into an arbitrary read and write primitive, hijack the control flow, and use return-oriented programming (ROP) chains to take full control over a system,” it explained.
Cloudflare also warned that AI-driven cybersecurity threats could dramatically compress vulnerability response timelines. However, it cautioned that simply patching faster may not be enough. Enterprises, it argued, will need more resilient system architectures capable of limiting the impact of vulnerabilities even before fixes are deployed.
There are already several examples that show how powerful Mythos is at detecting vulnerabilities. Mozilla reportedly identified and fixed 271 vulnerabilities in Firefox 150 while testing Mythos Preview, more than 10 times the number it found in Firefox 148 using Claude Opus 4.6.
According to a recent The Wall Street Journal report, security researchers using Anthropic’s Mythos model discovered a new way to bypass Apple’s macOS security protections by chaining together multiple vulnerabilities into a privilege escalation exploit. The researchers said the AI-assisted techniques helped them access protected parts of the system that are normally inaccessible.
Apeksha Kaushik, Senior Principal Analyst at Gartner, says that for banks and large financial services enterprises, the stakes are particularly high due to the sensitive nature of financial data and the critical role these organisations play in the economy. “AI-driven threats can bypass traditional security controls, adapt to defensive measures, and exploit weaknesses at a speed and sophistication that was previously unattainable,” she adds.
So, What’s the Fix?
In its latest blog post, Anthropic warned that models with cybersecurity capabilities similar to Mythos Preview will soon become more widely available, increasing pressure on the software industry to respond to vulnerabilities faster than ever before.
The company urged software developers to shorten their patch cycles, release security fixes rapidly, and strengthen default security configurations.
“Ultimately, Mythos-class models will enable developers to build far more secure software by catching bugs before they are deployed,” Anthropic said.
Padmanabhuni says Indian financial institutions need to move “from compliance-driven security postures to real-time, algorithmic resilience”, arguing that deploying AI in defence is no longer optional. He says AI-versus-AI automated patching, continuous red-teaming using the same class of models employed by adversaries, and strict human-in-the-loop controls for autonomous security agents are now essential safeguards.
He also calls on regulators, particularly the RBI, to introduce what he describes as a ‘Mythos Test’ for critical banking infrastructure—essentially a stress test to determine whether systems can withstand an AI-driven adversarial probing.
“There is a need for greater focus on threat intelligence, adaptive security architectures, and continuous monitoring,” Kaushik suggests, adding that talent shortages and the complexity of legacy systems continue to hinder the adoption of advanced AI-driven defence mechanisms.
She says collaboration between regulators, industry stakeholders, and technology providers is essential to sharing threat intelligence, developing best practices, and responding effectively to emerging risks.
Your reaction
Discussion
What's your take on this story?
No comments yet — be the first to share your view.