2 US Agencies Now Using Anthropic's Mythos to Hunt Software Flaws

For cybersecurity leaders, the news that CISA is wielding Anthropic's Mythos signals more than another vendor win—it’s the emergence of AI-powered adversarial testing as a standard federal practice. With two agencies now using a model built to exploit weaknesses, not just catalog them, the community must grapple with both the speed of discovery and the unresolved risks of AI dual-use in national security.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has begun using Anthropic's AI model Mythos to scan federal code repositories for security flaws, three sources familiar with the matter told Reuters, marking a significant step in the government's adoption of offensive AI for defensive purposes. The initiative, carried out by CISA's Attack Surface Evaluation team, has already uncovered a 'large number' of vulnerabilities, though the nature, severity, and scale of the flaws remain undisclosed. This development comes as Anthropic navigates a turbulent relationship with the U.S. government, having only months earlier been branded a supply-chain risk by the Pentagon after refusing to strip safety guardrails from its models. The early success of Mythos within both CISA and the National Security Agency (NSA) suggests a potential turning point, not only for Anthropic's government standing but also for the future of AI-driven vulnerability management in critical infrastructure.

“

For cybersecurity leaders, the news that CISA is wielding Anthropic's Mythos signals more than another vendor win—it’s the emergence of AI-powered adversarial testing as a standard federal practice.

The backstory is essential. In February 2026, the Pentagon designated Anthropic a supply-chain risk—a classification typically reserved for foreign firms suspected of espionage—after the company declined to modify its AI systems for autonomous weapons or domestic surveillance. A federal judge blocked that designation in March 2026, and tensions began to ease when Anthropic privately released Mythos, a specialized model designed to identify and exploit cybersecurity vulnerabilities. By April 2026, the NSA was already using Mythos, despite the earlier blacklist. CISA's confirmed usage now means at least two federal agencies are leveraging the same AI tool to proactively hunt for flaws that could be exploited by adversaries. This dual-agency adoption is noteworthy given how rapidly it followed the lifting of the legal cloud.

For cybersecurity practitioners, the CISA-Mythos project underscores a critical shift: AI is moving beyond alert triage and log analysis into full-fledged vulnerability discovery at scale. Traditional static and dynamic application security testing tools remain vital, but they often miss the nuanced, context-dependent logic flaws that an advanced language model might detect. Mythos' design to exploit vulnerabilities, not just identify them, suggests an adversary-simulation capability that could root out weaknesses human red teams overlook. However, this power cuts both ways. If such a model—or its training data, prompts, or weights—were compromised or repurposed by malicious actors, the same capability could supercharge zero-day hunting by nation-states or criminal groups. The lack of transparency around the CISA audits—no details on the types of vulnerabilities found, the volume of code reviewed, or the model's performance metrics—leaves the cybersecurity community with more questions than answers about the reliability and broader implications of AI-driven government security assessments.