Sitharaman, Mythos & Indian Banks: What CISOs Should Do

On 23 April 2026, Finance Minister Nirmala Sitharaman convened bank chief executives, regulators and IT Minister Ashwini Vaishnaw in an unscheduled meeting. The trigger: Anthropic's Claude Mythos — an AI model that autonomously found a 27-year-old OpenBSD vulnerability and thousands of zero-day flaws in every major operating system and web browser. Indian institutions are outside the controlled-access ring. This is what every Indian CISO should do this week — and the multi-layered defence Ogma already operates for Indian enterprises.

What FM Sitharaman Actually Said

The FM convened the meeting on the afternoon of 23 April 2026. RBI officials, the Indian Banks' Association (IBA), CEOs of major public and private sector banks, IT Minister Ashwini Vaishnaw, and senior CERT-In leadership attended. Two direct quotes from her, reported in Business Today:

She characterised the threat as "unprecedented and requires a very high degree of vigilance, preparedness and better coordination across financial institutions and banks." The meeting concluded with three operational directives, per Hans India:

• Real-time threat-intelligence sharing among banks, CERT-In and security agencies
• Finance Ministry + RBI threat assessments on AI-driven cyber risk to banking infrastructure
• IBA to develop a coordinated response framework for AI-augmented attacks

What Mythos Actually Does — Verbatim From Anthropic

Anthropic's Claude Mythos Preview disclosure (Anthropic Red, April 2026) and the Project Glasswing announcement describe a model designed for general intelligence that turned out to be unusually strong at offensive cyber. The capability claims, in Anthropic's own words:

Independent verification came from the UK AI Safety Institute (AISI) evaluation published 13 April 2026. AISI tested Mythos against expert-level CTF challenges and a 32-step corporate-network attack simulation called "The Last Ones" (TLO).

Why Sitharaman Convened the Meeting: The Glasswing Asymmetry

Anthropic chose not to release Mythos generally. Instead it set up Project Glasswing — a controlled-access programme in which a small ring of organisations gets early access to use the model defensively. The full partner list, per Anthropic:

Anthropic's framing is honest: "we believe that powerful language models will benefit defenders more than attackers" long-term, but "the transitional period may be tumultuous." Sitharaman's meeting is an Indian regulator preparing for that transitional period without inside access.

The Realistic Threat Model — Today, Not Tomorrow

Mythos is gated. But there is already a thriving market for AI-augmented offensive tooling at lower capability tiers — fine-tuned open models for vulnerability triage, agentic frameworks for autonomous reconnaissance, and the criminal stealer-log + ransomware ecosystem we covered in our recent FortiRecon Dark Web Field Guide.

For an Indian bank in 2026, the realistic Mythos-class threat model is:

1. Capability proliferation. Open-weights models trained on vulnerability research will catch up to a fraction of Mythos's capability over the next 6-18 months. Even 10% of Mythos's CTF pass rate is dangerous.
2. Asymmetric exposure. 99%+ of vulnerabilities Mythos found are unpatched. Once any subset leaks, the asymmetry between any one attacker holding pre-disclosure intel and the rest of the world racing to patch is massive.
3. Existing capability is enough. CERT-In's CIAD-2025-0018 advisory (June 2025) flagged 16 billion exposed credentials, "predominantly acquired through info stealer malware attacks." Indian banks already face daily probes from much less sophisticated tooling.
4. Compliance pressure. RBI, SEBI CSCRF and DPDPA 2023 don't care whether the breach was caused by AI or a malicious insider. Detection, breach notification timelines and audit evidence still apply.

The right answer is not to wait for a Mythos-specific defence. It is to harden the layers that any Mythos-class attack would have to traverse. That defence already exists — and Ogma already operates it for Indian enterprises today.

The Multi-Layered Defence Indian Banks Need (And Ogma Already Operates)

A Mythos-class threat — autonomous discovery, autonomous exploit, multi-stage chains, sandbox evasion — has to traverse five operational layers to land a successful breach. Each layer is independently auditable. Ogma runs all five as managed services for Indian BFSI, manufacturing and government clients today.

None of this is hypothetical. Every layer is operational; every layer has Indian BFSI, manufacturing and government clients depending on it. The IBA's "coordinated response framework" the FM asked for is, at the practitioner level, exactly this stack — operating across an enterprise, plumbed together so external threat intel triggers internal scans, triggers SOC triage, triggers automated response.

A 7-Day Mythos-Readiness Checklist for an Indian CISO

You will not stand up a five-layer defence in seven days from cold. But you can verify the foundations, find the worst gaps, and have an evidence package ready when RBI or your board asks the question that's coming this week.

✅ Key Takeaways

1. FM Sitharaman's 23 April 2026 meeting is a regulatory signal, not an emergency. The threat is preparedness for capability proliferation, not a Mythos-specific attack this week.
2. Mythos's verified capabilities (Anthropic + AISI) are unprecedented: 73% expert-CTF pass rate, autonomous chained-vulnerability exploitation, 27-year-old bug discovery. The class of capability is here regardless of who has access.
3. Project Glasswing's 12 partners include zero Indian institutions. India is preparing without insider access — which is exactly why the IBA framework matters.
4. The right defence is the multi-layer stack you already know: TI → VA → firewall config → BAS → 24×7 SOC. Every layer is independently auditable; every layer reduces a different attack vector.
5. Ogma already operates all five layers as managed services for Indian BFSI, manufacturing and government clients. Authorised Fortinet partner, NSE7-certified engineers, Indian business hours, India-context tuning.
6. This week's CISO playbook is concrete: inventory, dark-web scan, patch known-exploited CVEs, audit firewall egress, BAS your top-5 detections, validate SOC kill-chain time, brief the board.