Indian fintechs push for access to Anthropic's Mythos over cyberattack risk

Indian fintech companies are trying to get access to Claude Mythos ahead of the general public, and the motive is defense, not curiosity. For players that run payments, lending and huge pools of customer data, Anthropic's new model looks less like another AI novelty and more like a tool that can sharply shrink the time between discovering a vulnerability and a real attack. So a request for early access here means one simple thing: test your own infrastructure before someone else does. In this market, even a few hours' head start can matter when the systems at stake are payment gateways, anti-fraud systems and bank integrations.

The companies pushing for access include One97 Communications, Razorpay and Pine Labs. Their logic is clear: if Mythos really is better than most specialists at finding weak spots, it makes more sense for large financial platforms to use it for internal audits than to wait for attackers to get comparable capabilities. According to One97's chief, the conversation with Anthropic covered not only the timing of access but also exactly how the company plans to use the model, which points to strict vetting of users.

Anthropic does not yet plan to open Mythos to everyone. Instead, the company launched Project Glasswing, a controlled program that includes major technology and cybersecurity players such as Amazon Web Services, Microsoft, Apple, Google, NVIDIA, Cisco, CrowdStrike and JPMorganChase. More than 40 additional organizations responsible for critical software infrastructure received limited access for defensive work. Anthropic committed up to $100 million in model usage credits to the program, plus $4 million in direct support for security-focused open-source organizations.

The reason for this caution is the claimed capability of the model itself. Anthropic states plainly that the model has reached a level where it surpasses all but the most skilled specialists at finding and exploiting software vulnerabilities. According to the company, Mythos Preview has already found thousands of high-severity vulnerabilities, including in every major operating system and every major web browser.

This is not just static code auditing: the model is used to hunt zero-day issues, black-box test binaries, harden endpoint protection and run full penetration tests. The company says some of the flaws it found had gone unnoticed for years, and in some cases the model could not only point to a bug but also propose a working exploitation path. Anthropic's reports also say that in manual review, experts agreed with the model's severity rating in 89% of 198 reviewed cases, and were within one severity level in 98%.

This is especially sensitive for banks and fintechs: their stacks are usually complex, tied to partners, and often rely on legacy components that are hard to update quickly without risking the business.

The Indian market reacted fast. FACE, a self-regulatory association of more than 275 ecosystem companies recognized by the RBI, recommended that members strengthen their defenses, speed up patching of known vulnerabilities, set up continuous monitoring and report suspicious incidents to regulators immediately. For the industry, this is no abstract threat: fintech in India has grown on a dense network of APIs, mobile apps, payment services and integrations with third-party providers, so one successful exploitation chain can quickly spread across several market participants. Against the backdrop of these recommendations, the request for Mythos access looks less like an attempt to gain a competitive edge and more like an early-warning measure.

Similar concern is already visible outside India: in the US and the UK, regulators, central banks and the largest banks have separately discussed how such models could accelerate sophisticated cyberattacks faster than the market can rebuild its defenses.

The key takeaway is that Mythos-class models change the economics of cybersecurity itself. Finding deep vulnerabilities used to require rare expertise, weeks of work and expensive teams; now that process can shrink to hours and operate at far greater scale. For fintech, this means a new race: defenders will have to use the same tools that could potentially empower attackers.

The sooner large payment platforms can test their systems in defensive mode, the better the chance of shortening the window of risk. But another question is growing too: if access to such systems remains with a limited circle of companies and states, the strategic resource will no longer be just capital or data, but the ability to find weak spots in digital financial infrastructure faster than anyone else.