The circular can be accessed here.

The Securities and Exchange Board of India (SEBI) has named Anthropic’s Claude Mythos in a circular dated May 5, ordering every regulated entity in Indian securities markets to immediately overhaul their cybersecurity infrastructure. SEBI is the first Indian financial markets regulator to name a specific AI model in a formal circular; CERT-In had first named Mythos across all sectors on April 26.

The circular covers stock exchanges, depositories, mutual funds, brokers, credit rating agencies, custodians, merchant bankers, and portfolio managers, among others.

SEBI’s concern: Mythos can identify and exploit vulnerabilities “using speed and scale,” threatening data confidentiality, application integrity, and reliability of outputs. Because all market participants are interconnected, one breach can trigger a domino effect across the entire ecosystem.

SEBI has also constituted a task force called cyber-suraksha.ai, comprising representatives from market infrastructure institutions (MIIs), qualified registrars and transfer agents (QRTAs), and other regulated entities, to examine AI-driven cybersecurity risks, share threat intelligence, report cyber incidents on priority, and review third-party vendor security posture.

What the circular requires:

1. Patch immediately. All operating systems and applications must be updated right away. Where patches don’t exist yet, entities must use virtual patching, a temporary protective layer applied over a vulnerability when no official fix is available.
2. Run AI-based vulnerability assessments. Entities must conduct Vulnerability Assessment and Penetration Testing (VAPT), simulated cyberattacks used to find weaknesses before real attackers do, continuously using both conventional and AI-based tools, in line with SEBI’s Cyber Security and Cyber Resilience Framework (CSCRF).
3. Hold vendors accountable. Entities must engage third-party vendors on timely patching. Exchanges and depositories must specifically direct their empaneled application vendors to run comprehensive risk assessments on AI-led vulnerability detection models and implement safeguards, including patching, VAPT, and continuous monitoring.
4. Lock down change management. Every system change, including minor ones, requires full documentation, impact analysis, structured review, rigorous testing, and secure deployment.
5. Secure all APIs. An Application Programming Interface (API) is a connection point that lets different software systems communicate; in financial markets, APIs connect brokers, exchanges, and payment systems. The circular requires:

• Updated inventory of all APIs and apps using them
• Strong authentication on a least-privilege basis (users get access only to what they strictly need)
• Rate limiting and throttling to detect abuse
• Connections only via whitelist

6. Overhaul SOC monitoring. A Security Operations Centre (SOC) monitors an organisation’s systems for threats around the clock. The circular requires:

• Daily monitoring of all systems and networks including low-priority alerts that are typically ignored
• Implementation of a SOAR (Security Orchestration, Automated Response) playbooks integrated with SIEM (Security Incident and Event Management) solutions for automated threat detection and response
• Fast-track onboarding onto the Market SOC (M-SOC), a centralised 24×7 security platform run by NSE and BSE
• MIIs to run workshops to help entities integrate with M-SOC

7. Include AI as a risk scenario. Periodic risk assessments must now explicitly model AI model capabilities as a threat scenario.

8. Harden systems. Entities must adopt secure configurations, disable unnecessary services and default accounts, and enforce Zero Trust Network Architecture (ZTNA), a security model that requires verification at every step, assuming no user or system is trustworthy by default.

9. Update software inventory. Entities must periodically update their Software Bill of Materials (SBOM), a complete list of all software components, including open-source code, for all critical applications.

10. Build long-term AI defence. All regulated entities must prepare a long-term plan for using AI in detection and autonomous agentic mitigation, where AI systems independently identify and respond to threats without waiting for human instruction, including AI-augmented SOC transformation.

Why this matters: SEBI naming Mythos in a circular is a significant regulatory moment. As MediaNama has reported, no Indian company, bank, or government agency has secured access to Mythos under Project Glasswing, Anthropic’s $100 million restricted access programme. MeitY Secretary S. Krishnan confirmed on April 28 that India is still working out logistics with US authorities.

This creates a structural contradiction: SEBI is ordering Indian financial institutions to defend against a model they cannot access to defend themselves with. Claude Security, Anthropic’s enterprise defensive tool, gives Indian firms an indirect path through Infosys as a named partner, but runs on Opus 4.7, which produces two working exploits on the Firefox 147 benchmark against Mythos’s 181, a 90x capability gap.

MediaNama founder Nikhil Pahwa identified the core problem: “A tool that compresses attack timelines without compressing defense timelines increases systemic risk before it improves security.”

The data localisation conflict also remains unresolved. India’s 2018 rules require payment system providers to store all transaction data on servers within India, while Mythos is hosted on US-based servers. The National Payments Corporation of India (NPCI) has not publicly addressed this.

Finance Minister Nirmala Sitharaman chaired a meeting on April 23 with Reserve Bank of India (RBI), NPCI, Indian Banks’ Association (IBA), and CERT-In officials, calling the Mythos threat “unprecedented.” CERT-In has separately issued a high-severity advisory directing organisations to treat every newly disclosed vulnerability as exploitable within hours, not weeks.

Also read:

• India seeks access to Claude Mythos amid cybersecurity fears
• Claude Mythos puts India on alert: CERT-In, telcos, banks assess unprecedented cyber risks
• Anthropic launches Claude Security for enterprises, but stops short of Mythos-level capabilities