Loading story…
CISA is reportedly using Anthropic’s AI model Mythos to audit federal software and code repositories for security flaws, with the work led by the agency’s Attack Surface Evaluation team. According to Reuters, the initiative is intended to find and fix weaknesses in internal government systems before they can be exploited by foreign intelligence services or cybercriminals, and early use of the model has already uncovered a large number of vulnerabilities.
Officials have not disclosed which agencies or systems were scanned, the scope of the effort, or the severity of the findings. Reporting also indicates the NSA has experimented with or used Mythos in classified environments, underscoring broader U.S. government adoption of AI-assisted vulnerability discovery even as Anthropic’s government ties continue to draw policy and oversight scrutiny around safeguards, surveillance, weapons use, and model access restrictions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Security Affairs, citing Reuters, reported that the NSA had been using Anthropic's Mythos AI model since at least April. Testing reportedly found the model highly effective at identifying and exploiting weaknesses in sensitive government systems.
Sources cited by Reuters said the CISA initiative has already identified a large number of vulnerabilities in government software. No details were provided on the severity of the flaws or which systems were affected.
Reuters reported that CISA's Attack Surface Evaluation team is using Anthropic's Mythos AI model to audit federal government software systems and code repositories for vulnerabilities before they can be exploited. The scope of the scanning and the affected agencies or systems were not disclosed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourceteiss.co.uk
Open sourcewhbl.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Senior U.S. officials are considering giving the Cybersecurity and Infrastructure Security Agency access to Anthropic’s **Mythos** model so it can coordinate vulnerability scanning across federal civilian agencies, with a focus on finding public-facing weaknesses and other security flaws on government networks. The discussions come as agencies seek clearer direction on how advanced AI models will be used in cyber defense, following a White House push for stronger network security measures and CISA’s role in developing guidance and an AI vulnerability clearinghouse. CISA officials have stressed that AI could accelerate detection and prioritization, but would not replace remediation work, infrastructure modernization, or the reduction of technical debt. At the same time, the Trump administration has tightened control over Anthropic’s most advanced systems by placing **Mythos 5** and **Fable 5** under Commerce Department export restrictions, requiring licenses for export, re-export, or transfer to foreign persons. The move reportedly followed national security concerns after claims that Mythos had been jailbroken, and Anthropic said it suspended customer access to the affected models to comply while disputing the government’s rationale. The parallel actions highlight a split U.S. approach to frontier AI: expanding potential domestic cybersecurity use inside government while restricting broader access to the company’s most powerful models.
Jul 12, 2026
Anthropic restricted public release of its **Mythos** AI model after internal and external testing showed unusual strength in software vulnerability research, including the ability to analyze code, identify previously unknown flaws, and assess likely exploitability. The company said the concern was not the usual set of AI risks such as misinformation or hallucinations, but the possibility that advanced models could sharply accelerate vulnerability discovery and reduce a longstanding bottleneck in cyber operations. A U.S. official told the Associated Press that, during joint testing with U.S. intelligence agencies under Anthropic’s **Project Glasswing**, Mythos identified vulnerabilities in highly sensitive U.S. government systems within hours. Senator Mark Warner later said at a Senate hearing that the tool had broken into almost all classified systems within hours, citing information attributed to NSA and U.S. Cyber Command leadership, while Anthropic and outside experts argued the model’s capabilities could help defenders patch systems faster even as they raise the risk of faster exploit development and weaponization.
Jul 12, 2026
Anthropic’s **Mythos** vulnerability research model has drawn scrutiny over its potential to dramatically compress exploit development timelines, raising fears that attackers could move from discovery to weaponization in hours or minutes instead of days or months. Healthcare security experts warned that hospitals are particularly exposed because they depend on legacy clinical systems, connected medical devices, and operational technology that are difficult to patch and often lack modern protections. The concern comes as the healthcare and public health sector reportedly endured **460 ransomware attacks in 2025**, the highest total among critical infrastructure sectors in the FBI’s IC3 reporting, intensifying worries about patient safety, service outages, and faster coordinated ransomware campaigns. At the same time, officials and industry leaders are weighing whether Mythos-class tools could strengthen defense by improving anomaly detection, vulnerability prioritization, code and configuration review, legacy device testing, and incident response. In Washington, the Office of Management and Budget said it is **not** currently changing policy to give federal agencies access to Mythos, even as the White House examines the model’s cyber implications and coordinates with providers, industry, and the intelligence community on guardrails for any possible modified release. The debate is unfolding alongside broader friction between Anthropic and the administration, including litigation tied to a Pentagon supply chain risk designation and an order directing agencies to remove Anthropic tools from federal networks.
Jun 29, 2026