When the Attacker Is an AI: UPI's Free Model Meets a New Threat Class

The Threat Got Smarter. The Business Model Didn't.

Every layer of security built around UPI over the past decade was designed to stop a particular kind of attacker - a human one, working at human speed, with human limits on patience and imagination. That assumption just broke and the bill for fixing it is landing on an infrastructure that was never built to send anyone a bill at all.

What Mythos Actually Changes

Most cyberattacks on financial systems still start the old way: a human researcher or a criminal group, manually probing code for a weakness, often reusing known techniques. What UPI operators are flagging about Anthropic's Mythos Preview is a different mechanism entirely - an AI system that can search a codebase for previously unknown flaws on its own and then chain several small weaknesses together into a working attack path, without a human directing each step.

That collapses two things attackers have always needed: deep expertise and enough time to search exhaustively. A system that can do both at machine speed doesn't just add one more threat to the list - it changes what "adequate" defence even means, because the defender now has to out-think a search process, not a search team.

Why "Free" Was Always a Subsidised Choice, Not a Natural State

UPI has never actually been free to run - it has been free to use, with banks and payment service providers absorbing the cost since the government mandated zero-MDR in January 2020 to drive adoption. That trade-off worked because the cost side was predictable: server capacity, fraud monitoring, standard cybersecurity tooling, scaling roughly with transaction volume.

What UPI operators are now telling the government is that this cost curve has stopped being predictable. Security spending already eats over a fifth of annual platform costs, industry estimates suggest and defending against AI systems capable of autonomous exploit discovery requires dollar-denominated tools and specialised talent that don't get cheaper as volumes grow - they scale with the attacker's capability, not the defender's transaction count.

That is precisely why this has become the centrepiece of the renewed industry pitch for a Merchant Discount Rate: not a request to abandon a public good, but a warning that a zero-cost design built for a pre-AI threat model cannot indefinitely absorb a threat model that improves every few months.

For an aspirant, the real exam-relevant question here isn't "is UPI secure"

• it's whether a piece of digital public infrastructure can stay free at the point of use when the cost of defending it is now set by the pace of AI capability, not the pace of policy.