By Juraj Janosik, VP- AI, ESET
The emergence of Claude Mythos Preview has brought a long-running cybersecurity concern into sharper focus: what happens when AI systems become capable of finding, analysing, and helping exploit software vulnerabilities at scale?
For India, this is not a distant or theoretical question. As the country accelerates its ambitions in sovereign AI, digital public infrastructure, cloud adoption, and critical sector modernisation, its cyber resilience will increasingly depend on whether defenders can keep pace with machine-speed threats.
Developed by Anthropic and shared through Project Glasswing, Claude Mythos Preview has attracted global attention because of its reported ability to identify and reason through large numbers of vulnerabilities in widely used software. It has not been made publicly available, and in the cybersecurity community only a handful of companies, mainly US-based, have access to it.
But as was shown, similar capabilities could be achieved with already available models, even the open ones. Advanced AI models can help defenders, but they can also lower the barriers for attackers if placed in the wrong hands.
However, it is important to view Mythos in context. The concern that AI could be used to find and exploit vulnerabilities is not new. Since the early days of large language models, security researchers have warned that AI could accelerate code analysis, vulnerability discovery, exploit development, reconnaissance, phishing, and malware adaptation. Models capable of identifying bugs existed well before Mythos. What has changed is the speed, usability, and orchestration of these capabilities. With the right tools and workflows, AI can compress the time between identifying a vulnerability and turning it into an actionable attack path. This is the real shift. AI has not suddenly made cyberattacks possible, but it can make parts of the attack chain faster, cheaper, and more scalable.
This has direct implications for India. Organisations, especially those in critical sectors, must assume that the window to respond to newly discovered vulnerabilities will continue to shrink. In the past, defenders could rely on a slower cycle of disclosure, patch development, testing, deployment, and monitoring. That cycle is now under pressure.
This will likely contribute to more attacks exploiting known vulnerabilities, especially where patching remains inconsistent. Supply-chain attacks may also increase as attackers use AI to analyse dependencies, open-source components, and third-party software more efficiently. In many cases, the most damaging attacks will not depend on sophisticated zero-days. They will rely on older vulnerabilities, poor configurations, weak access controls, and delayed remediation.
This is why the conversation around Mythos should not be reduced to whether one model is dangerous or impressive. Mythos is reigniting the conversation about patching and vulnerability management and should prompt every cybersecurity vendor to ask whether their patching and vulnerability capabilities are fit for purpose. The industry has long treated vulnerability management as a background function; increasingly, it is a frontline one.
Many organisations still struggle with the fundamentals: knowing what assets they have, understanding which systems are exposed, applying patches in a timely manner, enforcing strong identity and access controls, and monitoring for unusual behaviour. These are not glamorous topics, but they remain the foundation of cybersecurity. AI will not make them less important. It will make failures in these areas more costly.
For India, the challenge is significant because of the scale and diversity of its digital ecosystem. Large enterprises, government-linked infrastructure, start-ups, small businesses, healthcare providers, financial institutions, and public service platforms all operate at different levels of maturity. Some have advanced security teams and mature processes. Others still rely on legacy infrastructure, manual controls, and limited visibility.
This unevenness is where AI-assisted attackers can gain an advantage. They do not need every organisation to be vulnerable. They only need enough exposed systems, unpatched applications, misconfigured cloud environments, or weak supplier links to create meaningful risk.
At the same time, AI is not only a tool for attackers. It is also becoming increasingly important for defence. Cybersecurity companies have used AI techniques for many years to improve detection, malware analysis, threat intelligence, and response. Today, these capabilities are expanding further. AI can help security teams search for adversarial signals in high-noise environments, reduce investigation time, and prioritise vulnerabilities that are most likely to be exploited.
This context matters. Not every vulnerability carries the same risk, and not every patch can be applied immediately. Organisations need intelligence to decide what must be fixed first. AI can accelerate analysis, but it cannot replace judgement, accountability, or a deep understanding of the operating environment. It should be treated as a force multiplier, not as an autonomous substitute for security strategy.
There is also a governance challenge. As open and widely available AI models are adopted across enterprises, many organisations are using them without adequate oversight of model provenance, data exposure, deployment security, or misuse risk. Employees may feed sensitive internal information into AI systems without fully understanding how that data is handled. Developers may rely on AI-generated code without sufficient review. Security teams may adopt AI tools without understanding their limitations.
Responsible AI adoption must therefore include clear policies on data protection, model usage, access control, auditability, and human oversight. The question is not whether organisations should use AI. They should. The question is whether they are using it in a way that improves resilience rather than creating new exposure.
For Indian organisations, the lesson is clear: AI will accelerate both attack and defence. The gap between the two will be determined by preparedness. India’s digital ambitions are significant. Its cyber resilience must be equally ambitious.