In such plans submitted to the Reserve Bank of India (RBI) to tackle emerging threats from frontier AI systems such as Claude Mythos, banks have proposed greater ownership of critical software code, reduced dependence on third-party vendors, and stronger protection of encryption keys and digital identities.
They have also suggested deploying advanced AI models to proactively identify and patch vulnerabilities in their own systems.
The RBI had asked banks and other regulated entities to complete a board-approved gap assessment and formulate a time-bound action plan by end-June to address risks arising from frontier AI models.
The central bank’s advisory followed growing concerns that models like Mythos-capable of detecting zero-day vulnerabilities in packaged software, scanning networks at unprecedented speed and autonomously probing security perimeters-represent a qualitatively different threat from conventional cyberattacks.
AgenciesFour-Pronged DefencesBanks have identified four foundational techniques to defend against AI-powered attacks, according to sources familiar with the plans being submitted to the RBI.
The first is code ownership and identity concealment. Since models like Mythos can autonomously scan networks and locate encryption keys, banks have told the RBI they should work toward greater ownership of their software code and adopt more sophisticated techniques to conceal software keys and network identities.
‘Imagine a third party coming onto our net banking perimeter and trying to look at this pipe-they will require keys to break the encryption. But Mythos is powerful enough to go and find those keys,” said a senior banker involved in drafting the plans. “Masking these identities effectively becomes a critical first line of defence.”