RBI Mandates Banks Complete AI Cyber Risk Assessment by June as Mythos AI Raises Financial System Alarm

RBI Mandates Banks Complete AI Cyber Risk Assessment by June as Mythos AI Raises Financial System Alarm​

The Reserve Bank of India (RBI) has introduced a stringent mandate requiring banks and other regulated entities to conduct comprehensive cybersecurity reviews focusing on frontier artificial intelligence models. These institutions must complete a board-approved gap assessment and prepare a timebound action plan addressing these advanced AI risks by the end of June.

This directive underscores the escalating nature of digital threats within the financial ecosystem. The exercise mandates that regulated firms implement a structured cybersecurity framework, conduct specialized AI-led threat testing, and identify existing systemic vulnerabilities.

RBI Issues Six-Month Deadline for Frontier AI Gap Assessment​

The issuance of this comprehensive mandate follows months of scrutiny into emerging technology risks. This move transforms a conceptual worry into a formal compliance timeline for the entire financial sector.

Frontier AI models are defined as advanced general purpose AI systems trained on massive datasets and capable of diverse tasks. These technologies, such as Mythos, present unique challenges to traditional cybersecurity protocols.

Finance Minister Nirmala Sitharaman previously addressed this challenge in April, labeling it a "new challenge" for the financial system. This prior meeting with bank chiefs assessed risks linked to these emerging AI models.

Understanding the Mythos Threat and Zero-Day Vulnerabilities​

The specific concern revolves around the capabilities of frontier AI like Mythos, developed by US firm Anthropic. The model is designed not just defensively but offensively, capable of identifying software vulnerabilities and security flaws before malicious actors do.

A core area of apprehension is the potential for misuse in identifying zero-day vulnerabilities. These are critical security flaws that are unknown to developers and have not yet been patched. Potential exploitation by bad actors heightens concern in the financial sector.

The availability of such tools creates a complex landscape. While Anthropic has expanded Mythos access to over 15 countries, Indian entities must contend with assessing risks using other advanced AI models currently available for operational use.

Fintech Sector Scrutinizing Advanced AI Security Risks​

Industry professionals are actively engaged in evaluating how these powerful AI systems impact security architecture. Some fintech firms sought controlled access to Mythos from Anthropic to assess the model and its safeguards thoroughly.

These companies are simultaneously assessing whether advanced AI usage could trigger concerns around data localization requirements or inadvertently expose internal system architectures. Data protection remains a primary focus during this period of heightened diligence.

One executive noted that vulnerabilities identified in critical digital public infrastructure, such as the Unified Payments Interface (UPI), are routinely patched. The permissioned architecture and limited participation surrounding UPI are cited as factors limiting security risks there.

Regulators Focus on Proactive Cybersecurity Preparedness​

The directive from RBI reinforces a commitment to proactive risk management across the financial sector. Prior to this mandate, the RBI had issued advisories assuring regulated entities of their preparedness regarding Mythos-related threats.

During earlier engagements, banks were strongly advised by Minister Sitharaman to take immediate steps to secure IT systems and protect customer data. Banks were also instructed to promptly report suspicious activities to CERT-In and maintain agency coordination.

As the industry addresses these risks, experts emphasize that vulnerability management is an ongoing cycle. The primary operational challenge identified by one executive remains achieving extremely high speed in deployment and patching cycles across all systems.