US cyber agency deploys Anthropic’s Mythos to detect software flaws: Report

The US Cybersecurity and Infrastructure Security Agency (CISA) has quietly begun using Anthropic’s artificial intelligence model, Mythos, to examine government software for security weaknesses, according to three people familiar with the programme cited by Reuters.

The initiative reflects a growing willingness within US agencies to deploy advanced AI systems for cyber defence, even as Anthropic’s relationship with the federal government has remained complicated in recent months.

According to the Reuters report, Mythos is being used to inspect government code repositories for vulnerabilities that could potentially be exploited by cybercriminals or foreign intelligence agencies. The work is reportedly being carried out by CISA’s Attack Surface Evaluation team, a specialist unit responsible for conducting penetration testing and broader security assessments across government systems.

More from Tech

The AI-assisted reviews have already identified numerous software flaws, reports Reuters. However, the report did not provide details about the scale of the vulnerabilities, the affected government systems or how much source code has been analysed. Reuters said it could not independently determine the number or severity of the issues uncovered.

A CISA representative had previously indicated that the agency would look into whether information could be shared about the programme but did not respond to subsequent requests for comment.

AI security tools gain traction despite political friction

The reported deployment comes at a notable moment for Anthropic, which has confidentially filed for a US initial public offering while simultaneously navigating a turbulent relationship with parts of the US government.

Earlier this year, the company found itself at odds with the White House and defence officials after declining to remove safeguards designed to prevent its AI models from being used for autonomous weapons or domestic surveillance. The disagreement escalated in February when the Pentagon designated Anthropic as a supply-chain risk, a classification more commonly associated with foreign firms suspected of posing espionage concerns.

That designation was later blocked by a federal judge in March, easing immediate restrictions on the company. Relations appear to have improved following the release of Mythos, a specialised AI model developed for cybersecurity tasks and described as highly effective at identifying and exploiting software vulnerabilities during testing.

The use of Mythos within CISA is not the first indication that US intelligence and security agencies have embraced the technology.

Axios previously reported that the National Security Agency (NSA) had begun using Mythos as early as April, despite the earlier Pentagon designation. More recently, The New York Times reported that NSA analysts had tested the model in classified environments and were impressed by its cybersecurity capabilities.

The company's cybersecurity strategy, however, has continued to attract political scrutiny. When Anthropic later introduced a public-facing version of Mythos known as Fable, it incorporated additional safeguards intended to limit offensive cyber misuse. Shortly afterwards, the White House reportedly pressed the company to restrict access to foreign users, resulting in a temporary global shutdown of the model.

That suspension was lifted only last week, marking another chapter in Anthropic's evolving relationship with Washington as government agencies increasingly rely on its technology to bolster cyber resilience while policymakers continue debating how advanced AI systems should be governed.