SEBI Forms AI Cybersecurity Task Force to Tackle Mythos Risks

SEBI Forms Cybersecurity Task Force Amid Mythos Concerns

The Securities and Exchange Board of India (SEBI) has established a new task force named ‘cyber-suraksha.ai’ to proactively address the escalating cybersecurity risks associated with advanced Artificial Intelligence (AI) models. This strategic move comes in response to growing concerns, particularly surrounding Anthropic’s potent AI model, Mythos, which has demonstrated an advanced capability to identify and exploit critical software vulnerabilities. The task force is mandated to develop a unified strategy for mitigating these AI-driven threats and to foster a collaborative environment for sharing threat intelligence and best practices within the financial sector.

Cyber-Suraksha.ai Mandate and Objectives

The primary objective of the ‘cyber-suraksha.ai’ task force is to devise a comprehensive mitigation strategy aimed at curbing the risks posed by sophisticated AI models. This includes facilitating the seamless sharing of threat intelligence, promoting best practices for vulnerability management, and developing playbooks to effectively respond to emerging threat vectors. Furthermore, the task force will prioritize the reporting of cybersecurity incidents and information regarding vulnerabilities. A crucial aspect of its mandate also involves reviewing the cybersecurity posture of third-party application service providers, including empanelled vendors, to ensure a robust security ecosystem across all regulated entities.

Composition and Stakeholder Inclusion

The newly formed task force will comprise representatives from key market infrastructure institutions (MIIs), qualified registrars and transfer agents (QRTAs), qualified regulated entities (QREs), and other relevant stakeholders. This inclusive composition ensures a diverse range of expertise and perspectives, enabling the task force to develop well-rounded and effective strategies. The inclusion of these entities is critical for a coordinated response to the complex cybersecurity challenges presented by advanced AI technologies, ensuring that mitigation efforts are practical and widely applicable across the financial market landscape.

Understanding the Mythos Threat

The formation of the task force is significantly influenced by the capabilities of Anthropic’s Claude Mythos, which was rolled out in a controlled manner in April. Designed for advanced coding and cybersecurity applications, Mythos can identify and exploit critical software vulnerabilities across major operating systems and browsers, including long-undetected flaws. Its potential for misuse has led Anthropic to restrict access under Project Glasswing. The model’s ability to uncover and exploit vulnerabilities has raised alarms globally, with potential implications for critical infrastructure such as power grids, telecom networks, banking systems, and defence infrastructure, highlighting the urgent need for regulatory oversight and preparedness.

SEBI’s Advisory and Recommended Measures

In light of these concerns, SEBI has issued an advisory to all regulated entities (REs) outlining essential cybersecurity measures. These include the immediate updating of all operating systems and applications with the latest patches, conducting thorough vulnerability assessments using AI-based tools, and performing regular cybersecurity audits. Entities are also advised to engage with third-party vendors for timely patch deployment, ensure full documentation and rigorous testing for all system changes, and maintain updated inventories of application programming interfaces (APIs). Additionally, strong authorization mechanisms, API rate limiting, and continuous system and network monitoring are emphasized. The advisory also mandates expedited onboarding onto market Security Operations Centers (M-SOCs) and the implementation of system hardening techniques, including zero-trust network principles, to minimize the attack surface.

Broader Regulatory Landscape and Future Preparedness

This initiative by SEBI follows closely on the heels of Finance Minister Nirmala Sitharaman’s meeting with heads of banks and senior officials from the RBI and NPCI to discuss cybersecurity risks posed by advanced AI systems. The Minister stressed the importance of high vigilance, preparedness, and enhanced coordination among financial institutions. Recent reports also indicate that the Indian government has engaged in discussions with the US government and Anthropic to explore mechanisms for Indian companies to access Mythos, suggesting a multi-faceted approach to managing the opportunities and risks presented by cutting-edge AI technologies. SEBI’s task force represents a significant step towards building a resilient cybersecurity framework in the face of evolving technological threats.