Mythos | Double-edged sword

Political & Constitutional Dimensions:

The government's response through Finance Minister Sitharaman's emergency meeting reflects the political priority given to financial sector cybersecurity. The establishment of a committee under C.S. Setty, a respected institutional figure, signals the gravity assigned to this threat. From a constitutional perspective, the right to privacy under Article 21 and the state's obligation to protect citizens' data interests are implicated. The IMF's recommendation that governments not treat AI as "purely technical" aligns with the Supreme Court's jurisprudence recognizing data protection as a facet of privacy. However, the challenge lies in balancing innovation with security — a tension that has no easy political resolution.

Critics argue that India's response remains reactive rather than proactive. The fact that government action followed reports of unauthorized Mythos access, rather than anticipating such risks, raises questions about institutional preparedness. The opposition may question whether regulatory frameworks are keeping pace with technological advancement.

Economic & Financial Impact:

The economic stakes are substantial. The financial sector's reliance on shared digital infrastructure means that a single successful cyberattack could cascade through the system. Banks using AI for customer service, risk management, and fraud detection face dual exposure — both as potential targets and as users of AI systems that could be compromised. The IMF's warning about "scalable, automated, and accessible" cyberattacks suggests a potential democratization of cyber threats, where even financially motivated criminals with limited technical skills could execute sophisticated attacks.

The cost implications are significant: remediation of major cyber breaches can run into thousands of crores, besides reputational damage and loss of public trust. The Mythos incident may also affect foreign investment flows, as international investors increasingly factor cybersecurity preparedness into allocation decisions.

Social Dimensions:

The social dimension centers on public trust in the financial system. If citizens lose confidence in the security of digital banking, it could reverse financial inclusion gains. The vulnerable sections most dependent on digital banking services — including migrant workers using UPI remittances and rural customers accessing credit — would bear disproportionate costs if cyberattacks disrupt services. The IMF's concern about interconnected legacy infrastructure compounds this risk, as such systems are often used by smaller banks serving underserved populations who lack alternatives.

Governance & Administrative Aspects:

The committee under C.S. Setty faces the challenge of recommending safeguards without stifling legitimate AI innovation. Key implementation challenges include: (a) real-time threat intelligence sharing requires interoperable systems across diverse banks; (b) legacy infrastructure upgrades demand significant capital expenditure; (c) CERT-In's capacity to coordinate responses at the speed AI-enabled attacks require. The federal structure adds complexity — while the RBI governs banks centrally, state-level financial institutions may fall outside coordinated frameworks.

The administrative response must also address the international dimension: since AI models like Mythos are developed abroad, domestic regulatory reach is limited. This necessitates coordination with international bodies and potentially bilateral engagement with AI-developing nations.

International Perspective:

Globally, the Mythos incident has prompted regulatory scrutiny. The EU's AI Act includes provisions for high-risk AI systems, though cybersecurity applications occupy a grey area. The US Cybersecurity and Infrastructure Security Agency (CISA) has issued similar warnings about AI-enabled threats. India's response must be calibrated against these international developments to avoid regulatory arbitrage while maintaining domestic security. The IMF's involvement signals that this is now a matter of international financial stability, not just national cybersecurity.