BT Explainer: What will Sebi’s new taskforce on AI do?

The unveiling of Anthropic's upcoming artificial intelligence model, Claude Mythos, has sparked global concern due to its purported ability to identify and exploit software vulnerabilities at an unprecedented scale. This has led to heightened discussions among governments and financial regulators worldwide regarding the potential dangers it poses to the stability of financial systems. In response to these concerns, India’s Securities and Exchange Board (Sebi) has established a dedicated task force named cyber-suraksha.ai. This initiative aims to thoroughly examine the challenges posed by advanced AI technologies. Sebi's decision to form this task force underscores the belief that rapid advancements in AI-driven tools, like Mythos, have introduced new and complex risks for entities under its regulation. The regulator has noted that such tools can significantly increase risk exposure by facilitating the detection and potential exploitation of existing security vulnerabilities with remarkable speed and efficiency. Additionally, they raise critical issues related to data privacy, application integrity, and the reliability of AI-generated outputs. The task force is composed of representatives from various market infrastructure institutions, qualified registrars, and other relevant stakeholders. A recent meeting convened by the task force brought together these entities to discuss the risks associated with AI models and strategize on necessary countermeasures. The mandate of cyber-suraksha.ai includes a comprehensive review of cybersecurity risks linked to AI technologies and the development of a coordinated approach to mitigate these threats. This involves sharing threat intelligence, establishing best practices for vulnerability management, and preparing actionable response strategies. Stakeholders will be required to promptly report any cyber incidents, malicious activities, or vulnerabilities to enhance the overall cybersecurity readiness of the financial market. In light of these discussions, Sebi has issued key advisories. It emphasizes the importance of immediately updating all operating systems and applications with the latest security patches to address identified vulnerabilities. In situations where patches are unavailable, temporary protective measures, known as virtual patching, should be implemented. Regular security audits are now mandated for regulated entities to align with Sebi's cyber resilience framework. Additionally, both conventional and AI tools will be utilized for thorough vulnerability assessments. Exchanges and depositories must also instruct their application vendors to conduct detailed risk assessments regarding AI-driven vulnerability detection models and implement necessary safeguards based on these evaluations. To ensure operational resilience, any modifications to systems, no matter how minor, will require comprehensive documentation and thorough testing before deployment. The Market Security Operations Center (SOC), established by the NSE and BSE, will continue to serve as a real-time security monitoring platform to detect threats across the digital infrastructure. With the increasing risks associated with AI-driven attacks, Sebi has urged all eligible regulated entities that have yet to engage with an M-SOC to expedite their onboarding process. Regular risk assessments of both regulated entities and their third-party service providers will now incorporate the capabilities of AI models into their evaluations. System hardening techniques will also be implemented to minimize vulnerabilities in IT infrastructure. Meanwhile, the Reserve Bank of India (RBI) is also actively addressing the challenges posed by AI technologies. Recently, RBI Deputy Governor Swaminathan J. highlighted the dual nature of AI, describing it as a "double-edged instrument" that could either enhance or undermine existing financial structures if not properly managed. He advocated for a balanced discourse regarding the application of AI in finance, cautioning against both uncritical enthusiasm and excessive defensiveness.