India is pushing for tighter control over advanced AI systems after concerns emerged about Anthropic’s new AI model, Claude Mythos, and its reported ability to detect and exploit software vulnerabilities.

According to sources cited by Moneycontrol, government officials recently met with Anthropic’s India team to understand the cybersecurity risks associated with the model and whether such systems could pose a threat to critical sectors such as banking, telecom, and power infrastructure.

The talks involved officials from the Finance Ministry, MeitY (Ministry of Electronics and Information Technology), and CERT-In. One key concern raised during the discussions was where these AI systems are hosted. Officials reportedly argued that models used in sensitive sectors cannot rely on servers outside India due to regulatory, security, and jurisdiction-related risks.

“Any such advanced AI model will only become meaningful for sovereign or financial-sector use if it is hosted within Indian territory or a government-approved sovereign cloud. Otherwise, there are clear jurisdictional and security concerns,” a source told Moneycontrol.

The government also pushed for what officials described as “sovereign AI access,” meaning that both AI models and processing infrastructure should operate within India. Sources said Anthropic has not yet committed to India-specific hosting arrangements.

CERT-In, SEBI and the Finance Ministry are already on alert: Scrutiny of Mythos has been building for weeks. CERT-In had earlier issued a high-severity advisory urging organisations to treat newly disclosed software vulnerabilities as exploitable within hours rather than waiting weeks. Finance Minister Nirmala Sitharaman also chaired a meeting last month with officials from RBI, NPCI, IBA and CERT-In and described the threat posed by Mythos as “unprecedented”.

SEBI has separately ordered stock exchanges, brokers, mutual funds and other regulated entities to immediately strengthen cybersecurity systems, specifically naming Mythos in a May 5 circular. The regulator also established a task force, cyber-suraksha.ai, to examine AI-driven cyber threats.

No Indian company in Project Glasswing: The concerns intensified after reports around Project Glasswing, Anthropic’s restricted cybersecurity testing programme linked to Mythos. Around 40 companies, most of them US-based, reportedly received early access to the system for defensive security research. No Indian company was part of the programme.

Officials were also assessing whether Mythos represented a genuine technological breakthrough or Anthropic was overstating its capabilities. “The meetings were not about policy formulation. Initially, the government wanted to assess whether the claims reflected a genuine technological leap or were being overstated,” a source said.

The issue has now expanded from cybersecurity into a broader governance debate around advanced AI systems. Officials reportedly raised concerns about private companies developing powerful cyber capabilities without regulatory oversight and about who gets access to such technologies.

The report comes amid growing concerns about whether Indian companies can defend themselves against systems they have no access to. Anthropic has launched Claude Security, a separate enterprise cybersecurity product based on its Opus 4.7 model.

Read more:

• Anthropic’s Mythos AI accessed without approval via third-party vendor route: Report
• Data breach reporting timeline under DPDP Rules 2025 explained
• Why India’s new cybersecurity directive is a bad joke
• Anthropic-Pentagon dispute: What it means for AI governance