CISA’s Mythos Audits Find ‘Large Number’ of Bugs in Govt Code, 3 Sources Say

For cybersecurity professionals, the revelation that CISA’s red team is deploying a frontier AI model to hunt for hidden bugs in federal codebases signals a paradigm shift. It suggests that AI-driven threat hunting is no longer theoretical but operational inside the government’s own cyber defense agency—and it’s already bearing fruit, with sources indicating a “large number” of flaws unearthed. The development raises critical questions about trust, supply chain risk, and the future of automated penetration testing.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has quietly begun using Anthropic’s advanced AI model Mythos to audit federal software for vulnerabilities, according to three people familiar with the matter. The deployment, carried out by CISA’s Attack Surface Evaluation team—a unit that conducts aggressive digital security assessments and red-team exercises across the government—marks a significant milestone in the intersection of frontier AI and national cyber defense. The news, reported exclusively by Reuters on July 6, 2026, reveals that Mythos is being used to scan government code repositories for bugs that foreign spies and cybercriminals could exploit. While the exact scale, nature, or severity of the discovered flaws remains unclear, two sources indicated that the audits had already uncovered a “large number” of vulnerabilities. The adoption comes amid a complex, often hostile relationship between Anthropic and the U.S. government, highlighting a paradox: the same administration that once blacklisted the startup is now relying on its most potent cyber tool.

“

Cybersecurity and Infrastructure Security Agency (CISA) has quietly begun using Anthropic’s advanced AI model Mythos to audit federal software for vulnerabilities, according to three people familiar with the matter.

The context of this standoff is crucial. In February 2026, the Pentagon took the extraordinary step of designating Anthropic a supply-chain risk—a label typically reserved for foreign companies suspected of espionage—after the San Francisco-based company refused to remove safety guardrails that prevented its AI from being used for autonomous weapons or domestic surveillance. The move sent shockwaves through the tech and defense communities, casting a shadow over Anthropic’s federal prospects. In March, a federal judge blocked the blacklisting, and tensions began to ease following the private release of Mythos, a model described as “extremely capable at finding and exploiting cybersecurity vulnerabilities.” The CISA engagement suggests that the operational value of Mythos has, at least for now, outweighed political and ideological concerns within certain corners of the government.

For the cybersecurity industry, the implications are profound. CISA’s use of an AI model to proactively hunt for vulnerabilities in live government code signals a shift from traditional static analysis and manual penetration testing toward continuous, AI-driven attack surface management at scale. If Mythos can indeed surface a “large number” of bugs that might have otherwise gone undetected, it could fundamentally alter the federal government’s vulnerability remediation rhythm, shrinking windows of exposure for nation-state adversaries. However, trust remains a delicate issue. There is no public information on how Mythos handles sensitive code, whether it stores or learns from scanned repositories, or how the results are validated. Given the recent history of supply-chain risk designation, some security professionals may question the wisdom of feeding source code to a company that was, until a few months ago, formally considered a threat to national security.