AI Cyber Threats: Indian Banks & Fintechs Preparedness

AI’s Dual Role: Enhancing Security and Creating New Threats

The global cybersecurity landscape is undergoing a seismic shift with the advent of advanced Artificial Intelligence. While AI promises to bolster defenses, it also introduces potent new threats. Anthropic’s ‘Mythos’ model, capable of autonomously exploiting software vulnerabilities, and Google’s confirmation of the first AI-built zero-day exploit, signal a new era of cyber warfare. OpenAI’s ‘Daybreak’ initiative further underscores the urgency in strengthening defensive AI infrastructure. This evolution means frontier AI is no longer just a tool for coding or information retrieval; it’s actively identifying weaknesses in systems that once took human experts months or years to discover. This paradigm shift necessitates a fundamental reevaluation of cybersecurity strategies, particularly for nations like India, which have heavily invested in digital public infrastructure for their financial sectors.

Government Mobilizes Against Emerging AI Cyber Risks

The controlled release of Anthropic’s Mythos has triggered significant concern among Indian policymakers. The AI model’s ability to uncover previously unknown software vulnerabilities, exemplified by its discovery of flaws in the highly secure OpenBSD operating system, has raised alarms. For India’s banking sector, a critical pillar of the nation’s economy, the implications are profound. The fear is that such advanced AI tools, if fallen into the wrong hands, could dramatically simplify the process of identifying and exploiting vulnerabilities. India’s aggressive digitization of financial services over the past decade has created a deeply interconnected ecosystem, making it susceptible to cascading failures. This heightened risk prompted Finance Minister Nirmala Sitharaman to convene a high-level security meeting with top bank executives. During this meeting, the minister highlighted the ‘unprecedented’ cybersecurity risks posed by AI and established a panel, led by SBI Chairman C.S. Shetty, to assess these threats. The government is now prioritizing faster threat-intelligence sharing among banks, regulators, and cybersecurity agencies like CERT-In.

Financial Institutions Rethink Cybersecurity in the AI Age

Beyond regulatory directives, Indian banks are actively reassessing their cybersecurity postures. The primary concern is that AI-native cyber tools can expose operational weaknesses that traditional security frameworks were not designed to handle. Ashok Vaswani, MD and CEO of Kotak Mahindra Bank, noted the shift from human-speed to machine-speed cyberattacks, emphasizing the need for enhanced detection and response capabilities. He stated, “We will step up efforts to identify any kind of vulnerabilities that we have and fix those vulnerabilities as quickly as possible.” Jaishiv Prakash, Director Analyst at Gartner, commented that while Indian banks already treat cybersecurity as a board-level issue, AI systems like Mythos could drastically reduce the time between vulnerability discovery and exploitation, potentially rendering conventional testing and patch-management approaches insufficient. Prakash elaborated, “Many banks have mature cyber governance, but they still depend on manual triage, fragmented asset visibility, slow vendor coordination, and legacy technology estates. Mythos-class systems will punish those weaknesses because they move the contest from human-paced security operations to machine-speed exposure discovery and exploitation.” Vinay Tiwari, CISO at Axis Bank, offered a nuanced perspective, suggesting that AI tools could also serve as capability amplifiers to strengthen systems and improve resilience. He added, “Evolving risks may surface vulnerabilities in highly interconnected environments, particularly where there is significant reliance on shared software platforms, third‑party providers, or open‑source components without adequate oversight. Over time, the gap may widen between organisations that treat resilience as an ongoing capability and those that rely primarily on periodic checks.”

Fintech Sector Faces Amplified Challenges from Offensive AI

The Indian fintech ecosystem faces particularly acute challenges from offensive AI systems. Unlike established banks with dedicated cybersecurity budgets and stringent regulatory oversight, many fintech startups operate with lean engineering teams and may lack the resources to adequately defend against sophisticated AI attacks. The interconnected nature of India’s fintech layer—integrated with the broader banking ecosystem through payment gateways, lending APIs, account aggregators, and embedded finance systems—presents a significant vulnerability. Malicious actors could exploit weaknesses in smaller fintech platforms to gain access to larger financial networks. For startups already grappling with profitability pressures and rising compliance costs, cybersecurity spending is poised to become a major operational priority. In response to these emerging threats, fintech players such as Paytm, Razorpay, and Pine Labs have reportedly sought access to Mythos from Anthropic to test their own systems for vulnerabilities. Paytm founder and CEO Vijay Shekhar Sharma indicated the urgency, stating, “We had an urgent call with Anthropic to check when they’re creating a second list of companies that will get access to Mythos.”

The Global Race for Digital Resilience

India is not alone in confronting these AI-driven cybersecurity challenges. The global race in frontier AI is increasingly becoming a contest to secure digital systems before these same systems can be used to break them. The critical question remains whether Indian regulators and financial institutions possess the foresight and capabilities to stay ahead of this rapidly evolving threat landscape. The proactive measures being discussed and implemented signal a recognition of the stakes, but the true test will be in the sustained execution and adaptation to the ever-advancing capabilities of AI in the cyber domain.