India's Securities and Exchange Board (SEBI — India's primary capital-markets regulator, equivalent to the US SEC) issued an urgent cybersecurity directive on May 6, 2026, ordering every class of regulated market participant to immediately review and harden their information security systems. The trigger: Anthropic's Mythos AI, a limited-access model capable of autonomously discovering and chaining zero-day vulnerabilities (previously unknown security flaws with no available patch) across real-world software at a speed and scale no human security team can match. The directive targets 19 entity classes — from mutual funds and stock exchanges to merchant bankers and KYC (Know Your Customer) data storage agencies — and coincides with parallel action from regulators in the United States, Singapore, Australia, and Hong Kong.
Mythos AI: Technical Details
Claude Mythos Preview is Anthropic's vulnerability-research AI, released in limited access in April 2026 and distributed through Project Glasswing — a consortium that includes AWS, Apple, Microsoft, Google, CrowdStrike, and Palo Alto Networks. The project's stated goal is to find and fix vulnerabilities in critical software before adversaries develop comparable capabilities.
What separates Mythos from conventional security tooling is its ability to reason about code semantics, not just surface-level syntax. A traditional fuzzer (a program that bombards software with random or malformed inputs to trigger crashes) can find memory corruption bugs. A SAST (Static Application Security Testing) tool flags known insecure patterns. Mythos does something categorically different: it reads a codebase the way a skilled security engineer would, understands the intended behaviour of a system, and identifies the gap between what the code is supposed to do and what an attacker can make it do.
That includes authentication bypasses, business logic flaws, and cross-component trust assumptions — the categories of vulnerability that scanners historically miss and that require human expertise to find. According to Anthropic's own red team, Mythos has found vulnerabilities across every major operating system and web browser. More than 271 zero-days were identified in Firefox alone, and over 99 percent of discovered vulnerabilities remained unpatched at the time of discovery.
The severity profile of Mythos-discovered flaws skews toward the Critical band on the CVSS v3.1 scale (Common Vulnerability Scoring System version 3.1 — the industry-standard framework for rating vulnerability severity from 0 to 10, where 9.0–10.0 is Critical). That is because the model gravitates toward remotely exploitable, low-complexity flaws that require no authentication and no user interaction — the exact conditions that produce a maximum CVSS score.
For defenders, the practical consequence is a compression of patch windows. Vulnerabilities that would have taken a human researcher weeks to discover can now surface in hours. For financially motivated or state-sponsored adversaries seeking Mythos-equivalent capabilities, the latency between discovery and working exploit collapses accordingly.
SEBI Advisory and the cyber-suraksha.ai Task Force
SEBI's May 6 advisory is not an informational bulletin — it carries regulatory weight. The regulator simultaneously constituted a formal task force, named cyber-suraksha.ai, comprising representatives from Market Infrastructure Institutions (MIIs — the exchanges, clearing corporations, and depositories that underpin Indian capital markets), Qualified Registrar and Transfer Agents (QRTAs), and regulated entities across the ecosystem.
The task force mandate is to develop AI-resilient cybersecurity frameworks specifically for the Indian financial sector. Its formation signals that SEBI views the Mythos capability gap as structural — requiring ongoing governance architecture, not a one-time patch push. The nine directives issued to all 19 regulated entity classes are:
- Maintain current patch status across all systems and dependencies
- Conduct comprehensive vulnerability audits using both conventional and AI-based tooling
- Inventory and harden all API (Application Programming Interface — software interfaces that allow systems to exchange data) endpoints
- Strengthen SOC (Security Operations Center — the team and tooling responsible for real-time threat detection and response) effectiveness
- Implement zero-trust networking (a security model in which no user, device, or system is trusted by default, even inside the corporate perimeter — every access request is verified independently)
- Disable non-essential services to minimise attack surface
- Establish IT committee governance for AI-driven threat mitigation
- Develop continuous vulnerability management programs that incorporate AI-assisted scanning
- Recalibrate risk assessments to account for AI-accelerated threat timelines
The three risk categories SEBI explicitly identified are: heightened vulnerability exposure through rapid AI-assisted discovery and exploitation; data confidentiality threats — particularly relevant for KYC databases and trade repositories holding personally identifiable information on hundreds of millions of retail investors; and application integrity and reliability risks that could cascade into broader market disruption.
Who Is Affected
Every SEBI-regulated entity falls under this directive. The 19 named entity classes span the entire Indian capital markets ecosystem: stock exchanges, clearing corporations, depositories, mutual funds, merchant bankers, portfolio managers, venture capital funds, alternative investment funds (AIFs — pooled investment vehicles for high-net-worth investors), stockbrokers, research analysts, investment advisers, credit rating agencies, KYC registration agencies, qualified foreign investors, foreign venture capital investors, foreign portfolio investors, infrastructure investment trusts, real estate investment trusts, and debenture trustees.
The highest-risk entities are those with large externally accessible API surfaces. India's National Securities Depository Limited (NSDL) and Central Depository Services Limited (CDSL) together hold custody records for over 100 million demat (dematerialized — digitally held rather than paper-based) securities accounts. A successful exploitation campaign against either would represent one of the largest financial-sector breaches on record.
India is not acting in isolation. According to Rest of World's investigation into the Mythos regulatory gap, the United States, Singapore, Australia, and Hong Kong have all issued parallel guidance or are actively reviewing their frameworks. In the United States, the CEOs of America's largest banks met with Federal Reserve Chairman Jerome Powell and Treasury Secretary Scott Bessent specifically to assess Mythos-related systemic risk. Euro-area finance ministers have scheduled discussions with banking supervisors, though the EU currently lacks access to Mythos under US export controls.
For Indian entities with cross-border operations or foreign subsidiaries, this creates a multi-regulator compliance scenario: the SEBI directive applies domestically, but parallel requirements from MAS (Monetary Authority of Singapore), ASIC (Australian Securities and Investments Commission), or HKMA (Hong Kong Monetary Authority) may apply to offshore entities simultaneously.
What You Should Do Right Now
Security and compliance teams at SEBI-regulated entities should act within the next 30 days:
- Run a full patch audit. Inventory every software component, library, and dependency across all systems. Prioritise internet-facing applications, authentication services, and API gateways first. Generate an SBOM (Software Bill of Materials — a machine-readable inventory of every software component and its version in a given system) if one does not already exist; it is the prerequisite for systematic patch tracking.
- Add AI-assisted vulnerability scanning. Conventional scanners miss the logic-level flaws Mythos surfaces. Supplement your existing DAST (Dynamic Application Security Testing — testing a running application by simulating attacker inputs) and SAST tooling with AI-powered platforms that can analyse business logic, not just known-bad patterns.
- Audit and harden all API endpoints. Enumerate internal, external, partner-facing, and deprecated APIs. Remove endpoints with no active consumers. Enforce rate limiting, input validation, and token-based access control on everything that remains. Run an automated API discovery scan — shadow APIs (undocumented endpoints that were never formally deprecated) are a common Mythos-class attack surface.
- Validate SOC detection coverage. Run a tabletop exercise (a structured discussion-based simulation of a breach scenario) or a purple team engagement (a collaborative exercise in which offensive and defensive security teams work together) focused on chained-vulnerability attack paths. Verify that your SIEM (Security Information and Event Management — a platform that aggregates and correlates alerts across the environment) fires on the relevant techniques before an adversary tests them in production.
- Document your AI governance posture. SEBI's directive requires formal IT committee guidance on AI-driven threat mitigation. Begin drafting your policy now — it should cover how AI tools are approved for use in your security programme, how AI-discovered vulnerabilities are tracked, and how risk assessments are recalibrated on an ongoing basis.
- Subscribe to CERT-In and SEBI circular updates. The Indian Computer Emergency Response Team (CERT-In) and SEBI's official circular portal will carry updates as the cyber-suraksha.ai task force develops its framework. Configure automated alerts for both.
Background: Understanding the Risk
The reason a single AI model is driving simultaneous regulatory action across four continents comes down to an asymmetry that has defined offensive security for decades — and that Mythos has now quantified in a way that is impossible for regulators to ignore.
Traditional vulnerability research is constrained by human bandwidth. A skilled researcher might find one exploitable flaw in a mature codebase over weeks of focused work. Automated tools like fuzzers and static analyzers extend that reach but still require human triage to separate signal from noise, and still cannot reason about the intended behaviour of a system.
Mythos removes that bottleneck. It can process entire codebases, identify individual weaknesses, understand how they interact across components, and produce a complete attack chain — autonomously, in hours. The implications for patch prioritisation are direct: vulnerabilities that existed unnoticed for years are now discoverable on demand, and the window between "vulnerability exists" and "adversary has a working exploit" is no longer measured in months.
For the Indian financial sector specifically, this matters because the attack surface is large and heterogeneous. Many regulated entities — particularly smaller stockbrokers, research analysts, and investment advisers — run legacy software with sparse patching histories and limited security budgets. These are precisely the environments where an AI-assisted adversary finds the most opportunity: complex, under-maintained codebases with no active vulnerability management programme.
India's financial sector has faced targeted intrusions before. The 2016 Bangladesh Bank SWIFT heist, in which attackers stole $81 million by compromising the bank's SWIFT messaging credentials, demonstrated the value of financial infrastructure as a target and the catastrophic consequences of a single authentication failure. A Mythos-class adversary does not need to find one authentication flaw — it finds all of them, ranks them by exploitability, and selects the highest-value entry point.
SEBI's response — a mandatory directive, a formal task force, and a compressed action timeline — reflects a recognition that the voluntary cybersecurity posture of its regulated entities is not calibrated for this threat environment.
Conclusion
SEBI's Mythos red alert is among the most operationally specific regulatory responses to AI-driven vulnerability discovery issued by any major financial regulator to date. For every entity in India's capital markets ecosystem, the action items are clear: patch aggressively, add AI-assisted scanning, harden API surfaces, and document AI governance now — not at the next annual review. The cyber-suraksha.ai task force signals that this is the opening move in a sustained regulatory arc, and entities that treat this circular as a checkbox exercise will find themselves poorly positioned when the follow-up assessments begin.
For any query contact us at contact@cipherssecurity.com
