From Mythos to Migration: AI Now, Quantum Next | QNu Labs

The Mythos Moment: Why Airtel Just Read the Signal Europe Has Been Writing

When the CTO of one of Asia's largest telecom operators publicly confirms the company is engaging global vendors over vulnerabilities surfaced by an advanced AI model, the headline is not the story. The shift underneath it is.

Bharti Airtel's response to Anthropic's Mythos is the first visible signal in Asia of an industry-wide reckoning that European regulators have already legislated against and that has now arrived in the boardroom worldwide.

What Mythos actually changed

In April 2026, Anthropic confirmed it was holding Mythos back from general release because the model can identify and potentially exploit serious software weaknesses. Major outlets reported the company was briefing a small set of large tech and financial firms studying it for defensive use. During seven weeks of testing, the model reportedly surfaced around 2,000 previously unknown vulnerabilities. By the week of April 21, the story had shifted again: Anthropic confirmed it was investigating allegations that a small group gained unauthorised access through a third-party vendor.

For two decades, defensive architecture rested on a quiet asymmetry. Vulnerabilities existed faster than attackers could find them. Mythos closes the gap. What used to require months of efforts, now happens in an afternoon, at scale, with a model. The same capability that gives defenders visibility gives adversaries reach.

The defender's paradox

Mythos hands defenders a capability and a problem in the same package.

The capability is real. Vulnerabilities - Including zero-days no human researcher had surfaced now appear at machine speed. A backlog that took a SOC three months to triage can be cleared in a week.

Then the problem starts.

Discovery just outpaced remediation: Finding 2,000 vulnerabilities in seven weeks is only useful if you can patch them fast. Most enterprise patch cycles still measure weeks per critical issue, not hours.

Prioritisation breaks at scale: The standard critical / high / medium / low triage model assumes a volume the human team can hold in its head. At machine-discovery speed, the queue itself becomes the vulnerability.

Adversaries inherit the same capability. Mythos itself is contained, but the class of model isn't — once a frontier system can do this, the same trick is reproducible by anyone with enough compute and weaker scruples. Defenders harden one estate at a time. Attackers only need to win once.

The cryptography underneath is already obsolete: Even when you patch the top of the stack faster, RSA and ECC : The primitives every patched system still relies on, are on a separate countdown. Harvest-now-decrypt-later is already running.

The question every CISO is now being asked privately is whether their environment: In-house systems, vendor APIs, endpoints, identity layers, cloud platforms and OT have the architectural posture to survive an attacker who can find what they couldn't and how will they secure the entire digital ecosystem.

That is what makes Mythos different from previous AI security stories.

Europe already decided

The UK and EU put hard civilian-sector deadlines on the table earlier than most of the world. The European Commission's PQC recommendation landed in April 2024, NCSC's phased migration timelines (2028, 2031, 2035) followed in March 2025, and the EU's coordinated 2030 roadmap arrived in June 2025 while most other jurisdictions were still publishing guidance, not deadlines.

The UK's National Cyber Security Centre has published a roadmap guiding critical sectors toward post-quantum cryptography by 2035, with phased planning and migration windows. NCSC's position is direct: PQC, not QKD, is the default migration path for most government and military use cases, and globally connected sectors like finance and telecom should move earlier because they depend on shared protocols and international interoperability.

Two timelines, one direction.

AI today. Quantum tomorrow.

These are not the same threat, and they cannot be addressed with the same tool.

AI accelerates the discovery and exploitation of vulnerabilities sitting on top of the existing system. It is painful and expensive. Organisations breach, recover, harden, and continue.

Quantum is different. A cryptographically relevant quantum computer breaks RSA and ECC, the encryption layer underneath every digital system in the world. Banking transactions, defence communications, identity infrastructure, healthcare records, sovereign data: All of it rests on mathematical assumptions that quantum physics retires. There is no patch and there is no workaround.

And the harvest is already happening. Adversaries are stealing encrypted data today, with no urgency to decrypt it. They are warehousing it for the day a quantum computer arrives. For any data with a shelf life beyond five years, that breach has already occurred and visibility is the only thing missing.

If your migration time plus your data shelf life exceeds the years until quantum capability arrives, you are already too late. The only variable any organisation controls is when they start.

Where this lands in practice

PQC is the default migration path. QKD is a targeted high-assurance tool. Crypto-agility is what makes either of them survivable.

For BFSI, the concern is long-lived confidentiality, payment integrity, identity, and regulatory scrutiny. UK financial-services guidance already treats quantum migration as a strategic planning issue, and the G7 Cyber Expert Group has called for a coordinated PQC roadmap. Most institutions will combine PQC for broad enterprise rollout with selective QKD for very high-value links — inter-bank, treasury, critical data-centre connections.

For telecom, the priority is core networks, signalling, subscriber data, and key management. NCSC has flagged telecom for earlier migration precisely because of its global interoperability constraints. Airtel's response is the first major Asian-carrier signal that the same pressure is now arriving outside Europe.

Automotive flips the timeframe. A car shipped this year may be on the road in 2040, running embedded software whose cryptographic dependencies were chosen before any of this was real. The work here isn't migration, it's designing for migrations you haven't met yet, across V2X, OTA channels, factory systems, and supply chains. Crypto-agility is the architecture.

Aerospace turns the dial up further. Command links and ground-to-satellite traffic carry confidentiality windows measured in decades and operate in contested environments. EuroQCI's space segment exists because no other framework has caught up.

What sits underneath all of these is the same architectural decision. Build crypto-agility into the stack now. Algorithm-swappable libraries, hardware roots of trust, controller-based deployments that push quantum-safe communications across large estates — and the migration becomes survivable as standards finalise. Skip it, and every layer becomes a separate rip-and-replace project later.

The category shift

What every leader in BFSI, telecom, government and defence, and critical infrastructure should now be discussing internally, is that reactive security has reached its operational limit.

The organisations staying ahead are building quantum-safe architecture before the regulation, the breach, or the headline forces the conversation. They are the ones who treated the quantum problem as an infrastructure deadline, not a research conversation, when the rest of the world was still debating timelines.

QNu Labs has been building for that deadline since 2016. A full stack quantum-safe platform. Sovereign IP, Hybrid PQC and QKD architecture, with QRNG-grade entropy at the foundation. Live deployments across defence, banking, telecom, government, space, and research.

That hybrid architecture answers the question Mythos forces: How do you secure an estate when the attacker's tooling keeps getting smarter? You stop using defences that weaken as quantum compute, AI, and agentic systems advance.

QKD's guarantee comes from the laws of quantum physics, not from a hard maths problem a future model might solve faster than expected.

QRNG entropy is sourced from quantum events, not algorithms an attacker can model.

PQC carries the load across the rest of the estate. In-house systems, vendor APIs, endpoints, identity, cloud platforms and OT.

One architecture across every layer: No rip-and-replace, no foreign dependencies, no partial fixes and no dependency on whether the next AI model is friendlier or fiercer than this one.

The Mythos moment is a warning. The harder warning underneath is: Quantum is not a future event. It is a planning constraint already shaping which organisations will still be standing five years from now.

The category is shifting from cybersecurity to cyber-safety. From reactive to proactive and from classical to quantum.

The window is open now, but it is closing sooner than you can imagine.

Start before it's too late. Get your quantum roadmap →

Sources

Mythos coverage and the Airtel response