What Claude Mythos means for India’s sovereign-AI push

What it is. On 7 April 2026 Anthropic announced Project Glasswing and, with it, Claude Mythos Preview, a general-purpose frontier model that it chose not to release publicly. Anthropic says the model can surpass all but the most skilled humans at finding and exploiting software vulnerabilities, and that it does not plan to make it generally available. Access went first to a group of launch partners and more than forty other organisations that maintain critical software, for defensive work. Mythos is a product of Anthropic; Codesnag and VirtualVakil are not affiliated with it.

Where India stands. Reporting on India’s access is mixed. Several outlets say Anthropic widened the programme on 2 June 2026 to about 150 more organisations in more than fifteen countries, India included, with only a handful of Indian entities reportedly admitted and their names not disclosed. Other reports say India still lacks access and that talks with the United States continue. We cannot resolve that from public sources, so treat any single claim as reported, not confirmed.

What the Government is reported to be doing. According to an Economic Times report carried by Inc42 and others, officials were briefed on 13 July 2026 that the Ministry of Electronics and IT had asked Sarvam AI and BharatGen to develop Mythos-like cybersecurity capability for critical infrastructure, to run on government-controlled, isolated compute, with no timeline set. MeitY Secretary S. Krishnan was reported as saying that the mix of open-source and indigenous models CERT-In is testing delivers roughly 60 to 70 per cent of Mythos’s capability. That is an official’s reported estimate about the Government’s own models. It is not a claim about Codesnag, and we do not make it.

Why sovereignty is the real story. Set the benchmark race aside. The episode showed that the most capable cyber-AI in the world can be withheld, rationed or switched off by a foreign company or a foreign government. For defence, government, banks and law firms, that is a supply-chain and confidentiality risk. A question typed into a foreign model is a question that has left the country. Sensitive infrastructure needs AI that is hosted, controlled and audited in India.

Where we stand. Our mission is simple to say: India needs its own Mythos, and we are building sovereign AI for cyber and legal. We do not claim parity with Anthropic’s model, and no benchmark of ours says so. What we stand on is narrower and checkable. We host and fine-tune open-weight models in India. In 2024, our sovereign offensive-security model autonomously solved the full PortSwigger Web Security Academy SQL-injection curriculum and conducted authorized web-application penetration testing. Everything since 2024 is classified and shared only with select, vetted key players under NDA and a scoped, authorized engagement.

What to do if you run something sensitive. Ask your AI vendors three questions: where are prompts and documents processed, which model sees them, and who can switch the service off? If the answers are abroad, a foreign model and a foreign company, you have found your exposure. Our sovereign AI page sets out how we answer those questions, and how vetted organisations can request access.