RBI Reviews Cybersecurity Risks of New Mythos AI Model
The RBI is consulting global regulators on cybersecurity risks from the Mythos AI model. New guidelines are being drafted to ensure AI use follows data rules.
The central bank of India has commenced discussions with global regulators, domestic financial institutions, and government officials to evaluate the potential risks associated with Mythos, a new artificial intelligence model developed by Anthropic. Preliminary assessments by the Reserve Bank of India (RBI) indicate that the model could pose significant cybersecurity threats by accelerating the identification and exploitation of software vulnerabilities. This concern is mirrored by regulators in the United States, Europe, and Asia, who have advised banks to strengthen their defensive frameworks. In Japan, the financial watchdog is set to meet with banks this week, while the central bank of Australia is actively monitoring developments related to the model.
Over the past two weeks, RBI officials have held consultations regarding Mythos with counterparts at the U.S. Federal Reserve and the Bank of England in the United Kingdom. The RBI may seek direct engagement with Anthropic to further investigate the system's architecture. Although Anthropic plans to provide access to European banks soon, the Mythos system is currently hosted on strictly controlled servers in the United States, which presents challenges for testing local data in foreign jurisdictions.
"Globally, we are discussing with other countries and other regulators on what are the developments and what safeguards need to be taken."
The National Payments Corporation of India (NPCI) is attempting to secure early access to Mythos alongside a select group of banks to identify vulnerabilities and "day-zero" cyber risks ahead of a broader rollout. Simultaneously, the RBI is preparing comprehensive guidelines for banks entering enterprise partnerships with advanced AI models, including the Claude family. These discussions emphasize that all analytics based on the data of Indian customers must comply with domestic data localization rules. Established in 2018, these regulations require all payment system providers in India to store end-to-end transaction data exclusively on servers located within the country.
