The level of concern is evident at the highest echelons—US Federal Reserve Chair Jerome Powell met with American bankers earlier in April, while India’s Finance Minister Nirmala Sitharaman and IT Minister Ashwini Vaishnaw recently convened with Indian bankers to discuss this issue.
What precisely is Mythos, and how does it differ from existing AI models?
It is not a general-purpose chatbot. Rather, envision it as a super-expert iteration of AI systems like ChatGPT or Gemini—not just a more intelligent chatbot.
Mythos is tailored for cybersecurity and coding, equipped to scan systems, identify weaknesses, and rectify them. However, these same abilities can also be exploited to infiltrate systems.
What sets it apart from previous AI models is its degree of autonomy. While older systems depend on step-by-step human instructions, Mythos can evaluate a large system, pinpoint vulnerabilities, and execute multi-step actions independently. It can analyze entire operating systems or browsers in just hours—tasks that typically require teams of experts weeks or months to complete.
Its most noteworthy function is identifying “zero-day” vulnerabilities—bugs that developers have yet to discover. These represent some of the most serious threats in cybersecurity.
Mythos has already uncovered numerous such vulnerabilities in widely used systems. It identified 271 issues in Mozilla Firefox during a single testing cycle. In OpenBSD, it revealed a 27-year-old flaw that could enable a remote attacker to cause a denial-of-service crash. In FFmpeg, utilized by platforms such as YouTube and Netflix, it detected a 16-year-old vulnerability that had passed through millions of tests. It has also signalled weaknesses in the Linux kernel, commonly used across devices and cloud services.
What concerns banks and regulators?
This advanced model presents both opportunities and risks. On the one hand, Mythos enables organizations to identify and remedy vulnerabilities before they can be exploited. Conversely, if such a system becomes widely available, it could empower individuals with minimal expertise to execute sophisticated cyberattacks.
This is why Anthropic has refrained from making Mythos publicly available. Access is currently limited to a select group of vetted organizations, including leading technology companies like Microsoft, Google, Nvidia, Apple, CrowdStrike, and Cisco, as well as entities like the Linux Foundation and major banks such as JPMorgan, Citigroup, Goldman Sachs, and Bank of America.
These institutions are rigorously testing the system under high-security conditions to detect and resolve vulnerabilities in critical software before similar capabilities are broadly released.
What measures is India taking to address potential risks?
In India, potential risks are being thoroughly evaluated, especially within the financial sector and digital public infrastructure like Aadhaar and Unified Payments Interface (UPI). The Ministry of Electronics and Information Technology is collaborating with global stakeholders to investigate access for domestic systems.
Following high-level discussions in April 2026, a panel comprising the State Bank of India’s Chairman and the Indian Banks’ Association has been established to evaluate risks and formulate a coordinated response for the banking sector.
This concern is not confined to India or the banking industry. Critical sectors such as aviation, healthcare, defense, and energy could also face repercussions.
As more advanced AI systems are developed, the challenge extends beyond their capabilities to how access to them is managed and utilized.
