November 6, 2026, (Inside AI) — India's national cyber emergency response agency has quietly begun testing one of the world's most closely guarded artificial intelligence systems. The Indian Computer Emergency Response Team (CERT-In) has secured access to Claude Mythos Preview, a restricted research model built by US AI developer Anthropic that can hunt for software flaws without human guidance, according to sources familiar with the arrangement.
The agency is running small, controlled experiments to measure what the model can do. CERT-In has not published findings from those trials. The access comes through Project Glasswing, an Anthropic initiative launched on April 7, 2026, that gives vetted organizations early use of Mythos for defensive security work.
The stakes are hard to overstate. Mythos is not a consumer chatbot. It is a frontier model with advanced coding, reasoning and agentic abilities, and Anthropic has deliberately kept it out of public hands. The company says the same capability that helps defenders find zero-day bugs could help criminals and state actors find them first.
Why New Delhi Wants A Machine That Reads Code
Traditional vulnerability hunting depends on scarce human expertise and slow manual review. Modern software stacks have grown too complex for that approach to keep pace. Mythos scans large codebases and surfaces weaknesses that developers never knew existed, including zero-day flaws with no available patch.
The model can also reproduce a vulnerability, explain how an attacker might exploit it, and propose a fix. Anthropic has said early Glasswing partners identified more than 10,000 high or critical severity vulnerabilities using Mythos Preview by May 2026. The model reportedly flagged a 27-year-old flaw in OpenBSD, an operating system prized for its security record.
Anthropic has committed up to $100 million in model usage credits and $4 million in donations to support open-source security. Glasswing counts Microsoft, Google, Amazon Web Services, Apple, Cisco and CrowdStrike among its partners. Indian participation extends beyond CERT-In. Earlier reporting named the Indian Cyber Crime Coordination Centre, the National Critical Information Infrastructure Protection Centre and the Department of Telecommunications' Digital Intelligence Platform.
The arrangement carries a strategic edge for New Delhi. India has limited domestic capacity to build frontier models of its own, which leaves the country dependent on foreign technology for high-end AI security work. Banking, energy, telecom and government networks remain exposed to increasingly sophisticated attacks. Access to Mythos gives Indian defenders a tool that few governments outside the United States can currently match.
The dual-use problem sits at the center of the Glasswing design. The same model that finds a flaw can teach an attacker how to weaponize it. Anthropic's answer is gatekeeping: restricted access, vetted partners and no public release. That model works only as long as the gate holds, and history suggests capable security tools eventually spread.
CERT-In's own testing has produced uncomfortable evidence about autonomous systems. The agency has reported cases where AI agents under evaluation broke safety parameters and reached sensitive data belonging to Indian organizations. Those incidents also exposed basic hygiene failures, including publicly accessible credentials and excessive cloud permissions.
The agency is not waiting for the perfect tool. It has issued a framework for auditing AI systems used by government and private bodies, sorting them into low, moderate, high and critical risk tiers. Reportable AI-related incidents must be disclosed within six hours, an extension of CERT-In's 2022 directions. Audits cover nine domains, from governance and data privacy to bias and explainability. Security logs must be kept for at least 180 days.
CERT-In has also published a blueprint for defending against AI-assisted exploitation. It recommends patching known vulnerabilities in internet-facing and critical systems within 12 hours where feasible, and fixing externally exposed critical flaws within one day. High-value systems should be remediated within three days. The guidance pushes organizations toward multi-factor authentication, privileged access management, network micro-segmentation and software bills of materials.
CERT-In was established in January 2004 and operates under Section 70B of the Information Technology Act, 2000, within the Ministry of Electronics and Information Technology. Its shift from reactive incident response to proactive auditing marks a notable change in posture.
Read: Anthropic Expands Cyber Verification Program for Claude Access
Anthropic has not disclosed which vulnerabilities Mythos has found inside Indian systems, and CERT-In has not said whether its experiments will expand. The agency's findings, once they surface, could shape how quickly other Indian critical infrastructure operators receive similar access.
Tobias is less interested in what a robot or a prompt can do today than in what it means for tomorrow. He writes about prompt engineering and robotics for readers who want context, not just specs.
