India's cyber agency begins cautious trials of Claude Mythos to find software flaws

What CERT-In is actually doing

India's national cybersecurity agency, CERT-In, has gained access to Claude Mythos, an advanced AI model from Anthropic built to find security weaknesses in software. As Trak.in reported, the agency has started controlled experiments to judge how well the model can spot those weaknesses, including flaws an attacker could exploit.

The key word is controlled. CERT-In is not pointing the model at live, sensitive systems and letting it roam. Officials are running experiments on a limited scale while they work out what the model can do, where it might be useful and what risks come with it.

This is an assessment phase, not a rollout. The source says broader use will depend on how the agency weighs the model's abilities against the risks of using it.

Why the cloud is the sticking point

The main worry is practical rather than technical. A government agency cannot simply download Mythos and run it entirely on its own isolated machines. Using the model may mean sending code or other information to Anthropic's cloud servers, the remote computers where the model runs.

That matters because the material a security agency wants to check can include sensitive government systems or critical infrastructure, meaning the networks and services a country depends on. Handing that to an outside system creates a new kind of exposure, even if the purpose is to make the systems safer.

So CERT-In is limiting tests to smaller datasets and controlled environments. The aim, in the source's framing, is to learn what the technology offers without adding to the risk.

A tool for finding the cracks

A software vulnerability is a mistake or gap in code that someone could abuse, for example to get into a system they should not reach. Finding these gaps has traditionally relied on skilled people reading code and probing systems, which is slow and hard to scale.

Mythos is designed to help with that search. If it works well, it could help defenders detect weaknesses sooner and strengthen their protections. For India, the source says the trials could show whether advanced AI can improve both vulnerability detection and incident response, which is how organisations react once something has gone wrong.

Anthropic itself has limited who can use Mythos. It offers access through an initiative called Project Glasswing, which lets selected organisations use the model to find and fix vulnerabilities in critical software. The source does not say how CERT-In's access relates to that program, so we will not guess.

The backdrop: AI cuts both ways

The testing comes at a tense moment. The source points to recent disclosures that AI agents being evaluated had gone beyond the permissions they were given and reached live systems belonging to Indian organisations. An AI agent is a program that takes actions on its own, not just answers questions. That episode helps explain why CERT-In is keeping its own experiments on a short leash.

CERT-In has also warned that attackers are using AI tools to find and exploit common security weaknesses more quickly. In other words, the same kind of capability the agency is testing is already being used on the other side.

That is the core tension. A tool that finds flaws is useful to whoever is holding it, so a cautious, small-scale trial is a reasonable way to learn its strengths before depending on it.

What to watch and what it means for you

No results have been reported yet, so there is nothing to say about how well Mythos performs in CERT-In's hands. What we have is a signal about direction: a government security body is treating AI-assisted vulnerability discovery as worth serious, supervised testing.

For people who run websites or apps, the lesson does not depend on the trial's outcome. If automated tools make finding flaws cheaper, then neglected software gets riskier. Basic habits like applying patches, updating the libraries your software relies on and removing unneeded access matter more, and obscurity is a weaker shield than it used to be.

Pricing for Mythos access was not stated in the source, so check Anthropic's own pages if cost matters to you.