Cyber storm ahead: India needs an urgent framework to tackle rising attacks

Talking to experts in the field, one gets a sense that with the launch of Mythos, we are at a watershed moment in the field of cybersecurity. I don’t think investors are fully aware of the cyber risks that are now on our doorstep. While we have all seen recent reports of OpenAI and Anthropic models jumping their sandboxes or safeguards and autonomously attacking third-party sites such as Hugging Face, the risks are much deeper and more widespread. JPMorgan Chase has done some very good work on this topic, and I have used its research to better understand the issues. 

First of all, the introduction of Mythos and GPT-5.5 has revolutionised the use and effectiveness of artificial intelligence (AI) in detecting cyber vulnerabilities. We are about to witness a deluge of previously undetected vulnerabilities in both software and hardware that these new Mythos-like models can now identify. Anthropic and participants in Project Glasswing found more than 10,000 new high- and critical-severity cyber vulnerabilities during the first month of use. 

Ninety-five per cent of these vulnerability disclosures had no public advisory at the time, meaning they were not listed on vulnerability databases and thus not widely known. A report by Epoch AI showed that critical cyber vulnerabilities reported by 21 leading technology companies went from less than 10 to 400 following the release of Mythos. Another scary fact is the study produced by the United Kingdom’s AI Security Institute. It showed the ability of both Mythos and GPT-5.5 to autonomously complete a 32-step corporate network attack simulation encompassing a full network takeover. Before this, AI models could not even complete half the test. 

These leading models now have the ability to chain low- and medium-cyber vulnerabilities into cyberattacks using approaches never seen before. The length and complexity of tasks these leading edge models can complete autonomously is doubling every 3-4 months. So vulnerability detection and exploitation will further accelerate. 

The median time for vulnerability exploitation has fallen from one year in 2021 to a projected one minute in 2027! No time to prepare. 

These capabilities are not only confined to the frontier American models. The leading Chinese models are only 6-9 months behind. The fact is that despite its remarkable cyber hacking skills, Mythos was not designed for this purpose, its cyber skills are a byproduct of its training and thus should be replicable by the Chinese models through distillation and similar training techniques. The real risk is that these Chinese models are open weight, downloadable and can be easily jailbroken. According to most experts, the safety controls on downloaded models can be removed within one hour by publicly available tools like Heretic. Once modified, these models respond to prompts on topics they were initially designed to refuse to engage with.

Tools like Heretic have been used to produce over 3,500 modified model variants (source: Akerman Intelligence Alert). The jailbroken version of Z.ai’s model GLM 5.2 is available on the Hugging Face site with over 10,000 downloads. 

All this implies that cyber capabilities that were once the preserve of state actors will soon be available for ransomware, terrorist organisations or even individual hackers. The vectors from which a cyberattack can originate have just multiplied and therefore so has the complexity of defending against these attacks. 

An underappreciated weakness is the use of open source code. It is far more ubiquitous than people think. Of all commercial codebases, 95 per cent contain open source components. A 2022 Linux Foundation study found that between 70 and 90 per cent of any given software codebase is made up of open source components. 

The open source ecosystem varies in depth and maturity. Some open source is backed by well-funded foundations with sufficient engineering resources, others are small groups of volunteers who support the software as a hobby. Almost 94 per cent of open source projects had fewer than 10 developers accounting for more than 90 per cent of the code. These components will typically have very few maintainers who keep the code secure and address vulnerabilities. This is the danger. Can these small teams of pro bono maintainers handle the upcoming deluge of patches needed to keep the code safe? Most concerning is that parts of the open source system can come under the control of bad actors with malicious intent. The bad actors can pretend to be volunteers and exploit the culture of trust that the open source ecosystem is built on. 

There is the whole sphere of non-cloud physical infrastructure that needs enhanced protection as well. Internet-exposed industrial control systems that manage power grids, water systems and pipelines are particularly vulnerable to disruption. Just because they are not on the cloud does not protect them. 

The introduction of AI models with Mythos-level capability has changed the game for cybersecurity. When attackers can reverse engineer a patch and weaponise it in minutes, speed of response has become critical. At the moment, enterprises are notoriously slow in implementing patches as they try to optimise system uptime and avoid patch-related disruptions.

Talking to experts, one gets the sense that India has to urgently upgrade its software, especially in the states and the small and medium enterprise sector. Much of it is very old. 

In India, we may need to implement a cash-for-clunkers programme to encourage our state-level infrastructure providers to upgrade to the latest software. When patches are released, they will only be for the latest versions of software. Many of our service providers, be they state electricity boards, municipalities or water utilities, run outdated versions that are very vulnerable. 

We may also need to put in place a central-level cyber defence agency, with the authority to help critical infrastructure sectors or key enterprises during a cyberattack. We need indigenous cyber capability and coordination. In today’s wars, cyberwar is part of the toolkit. We must expect cyber disruption to be attempted on a mass scale. Do we have an SOP in place to handle cyber disruption? Attacks from state actors cannot be handled at an individual enterprise level. 

We have to create a framework for information sharing among all affected parties, a clearing house type of mechanism so that we know who has been attacked and by what. It cannot be that no large Indian corporation has been hacked? Have the learnings from any such attack been shared? Are we sharing best practices among our large companies? 

There are many things to be done. There is very little time. A deluge of cyber vulnerabilities is on our doorstep. The attackers are fragmented, getting more sophisticated by the day and difficult to defend against. I hope I am wrong, but one does not get a sense that corporate India or its boards are seized of these issues. Reading Indian balance sheets, cyber risk is hardly mentioned. Most boards have very limited cyber expertise. The writing is on the wall. We must be prepared for the disruption ahead.

---

The writer is with Amansa Capital