US Cyber Agency Uses Anthropic Mythos to Audit Government Code for Bugs

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has started using Anthropic’s advanced AI model, Mythos, to audit government software for vulnerabilities.

This marks a significant shift toward AI-assisted cyber defense operations. Sources familiar with the initiative report that CISA is deploying Mythos to systematically scan federal code repositories to identify security flaws that foreign adversaries or cybercriminal groups could exploit.

This move demonstrates the government’s increasing reliance on AI-driven tools to enhance software supply chain security and proactively detect exploitable weaknesses in critical systems.

US Cyber Agency Uses Anthropic Mythos

The audits are reportedly being conducted by CISA’s Attack Surface Evaluation (ASE) team, a specialized unit tasked with performing penetration testing, red teaming, and comprehensive security assessments across federal infrastructure.

By integrating Mythos into its workflow, the ASE team is automating large-scale code analysis, enabling faster identification of vulnerabilities, including insecure coding patterns, misconfigurations, and potential zero-day exposures.

According to Reuters, two sources indicated that the AI-assisted reviews have already uncovered a substantial number of vulnerabilities. However, specific details regarding severity, affected systems, or remediation timelines remain undisclosed.

While the exact scale of the scanning effort is unclear, the use of Mythos underscores a broader trend of adopting AI models capable of offensive security reasoning, including vulnerability discovery and exploit simulation.

Mythos has been described as particularly effective at identifying complex attack paths and chaining multiple weaknesses. These capabilities traditionally require significant manual effort from experienced security researchers. This positions the tool as a force multiplier for federal cyber defense teams managing vast and diverse codebases.

The development comes amid a complicated and evolving relationship between Anthropic and the U.S. government. Earlier this year, tensions escalated when Anthropic refused to remove safeguards designed to prevent its AI models from being used in autonomous weapons systems or domestic surveillance programs.

In response, the Pentagon issued a formal supply chain risk designation against the company, effectively blocking its technology due to compliance and operational control concerns. However, that designation was later blocked by a federal judge, allowing limited engagement with Anthropic’s tools to resume.

Subsequent developments suggest a gradual normalization of ties. Intelligence agencies, including the National Security Agency (NSA), have reportedly been testing Mythos in classified environments since at least April 2026, with early feedback indicating strong performance in cybersecurity applications.

Despite initial restrictions, internal evaluations appear to have reinforced confidence in the model’s utility for vulnerability research and threat analysis.

Complicating matters further, Anthropic’s release of a public-facing version of Mythos, known as Fable, triggered policy concerns within the White House over potential misuse by foreign entities.

This led to temporary export controls and access restrictions, briefly halting the model’s global availability, which were lifted in late June. The incident highlights ongoing tensions between innovation, national security, and AI governance.

CISA’s adoption of Mythos ultimately signals a strategic pivot toward integrating cutting-edge AI into federal cybersecurity operations, particularly for proactive vulnerability discovery. As threat actors increasingly exploit software weaknesses at scale, the use of AI-driven auditing tools may become a cornerstone of defensive cyber strategy across government and critical infrastructure sectors.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN