National security | Code red for Indian defence

India’s defence architecture relies on a web of software-driven communication systems, satellite networks, radar installations, air defence mechanisms and logistics chains. The emergence of advanced AI models like Anthropic’s Claude Mythos introduces a new category of risk. Experts believe that in the hands of malicious actors, Mythos-like AI could scan military-grade software to uncover hidden or previously unknown vulnerabilities at a negligible cost. Unlike traditional cyber threats that depend on human expertise and take time, such AI systems can automate vulnerability discovery and exploitation at scale, drastically reducing response windows. In a worst-case scenario, adversaries can infiltrate defence networks, disrupt satellite communications, break logistics chains essential for troop movement and resource deployment as well as compromise the integrity of radar and air defence systems. All this can weaken operational preparedness; during a conflict scenario, this can prove fatal. The integration of such advanced AI into offensive cyber operations demands a fundamental shift in how India approaches strategic defence preparedness.

Jaijit Bhattacharya, president, Centre for Digital Economy Policy Research, says the main risk from models like Mythos is the short time period between identifying vulnerabilities and their subsequent exploitation, and the fact that they can discover weaknesses faster than cyber defences can repair them. Rumoured Chinese versions of Mythos, he says, could be delivered to India’s adversaries and would imperil defence, telecom and energy infrastructure that are run on connected software layers.

“The same tech that can help defenders discover weaknesses and seek remedies can also help adversaries launch attacks. India needs controlled-access frameworks, mandatory AI-red team testing for defence and critical infrastructure, indigenous cyber-AI capability, and closer coordination between MeitY (ministry of electronics and information technology), CERT-In (Indian Computer Emergency Response Team), the defence ministry, DRDO (Defence Research and Development Organisation), NTRO (National Technical Research Organisation) and other sectoral regulators,” says Bhattacharya.

Rohit Kumar Sharma, research analyst at the Manohar Parrikar Institute for Defence Studies and Analyses, says that since the intended use of Mythos is to secure systems, it appears to be a force for good, unless it falls into the wrong hands. He also thinks that the Mythos scare creates the condition for an AI-driven cyber arms race.

Rahul Dwivedi, founder & CEO of Pelorus Technologies, a firm that provides digital forensics and surveillance, says that the Mythos breakthrough underscores a dangerous reality: AI has tilted the balance towards offence.

With the speed asymmetry between offensive and defensive measures (which can take months), India’s infrastructure—reliant on US software and Chinese hardware—is especially exposed. We must do four things, says Dwivedi. First, establish a national programme tasked with running continuous AI-powered vulnerability discovery across every software platform and hardware component used in defence networks and critical installations. Second, New Delhi must develop its own offensive AI capabilities—to ensure it can credibly operate in the intelligence domain. Also, rather than rely on generalised global models, India needs to train sovereign AI models on its own intelligence holdings so that the results reflect its specific threat environment. Lastly, it must reduce the response time gap, enabling its systems to detect, patch and neutralise threats in hours.

Ankush Tiwari, CEO of pi-labs.ai, an AI firm, says Mythos represents a paradigm shift in cyber warfare. “Just as machine guns enabled high-volume fire that overwhelmed defences, Mythos reduces discovery of weaknesses from hundreds of man-hours to mere seconds or minutes with tireless efficiency, creating an asymmetric advantage,” he says. According to him, Mythos poses a threat in the short term, but when harnessed ethically, it holds immense potential for proactive defence.

Experts point out that to counter such adaptive threats as Mythos, organisations must prioritise air-gapped infrastructure, strict data sovereignty and develop AI models that remain under internal control. Ultimately, Mythos signals the urgent need to move beyond third-party AI solutions towards self-reliant architectures.