![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
July 08, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/07\/Anthropic-Claude-Code-Security.png\")
<\/p>\n
CISA is using Anthropic\u2019s Mythos AI to scan federal code for vulnerabilities, aiming to find flaws before hackers and foreign intelligence services.<\/p>\n
Three sources familiar with the matter told Reuters that CISA, the U.S. government\u2019s civilian cyber defense agency, is running Anthropic\u2019s Mythos<\/a> AI model against federal code repositories to find vulnerabilities before foreign intelligence services and criminal groups do. <\/p>\n Neither CISA nor Anthropic commented on the record. A CISA representative said last month he\u2019d check whether there was anything to share, then stopped responding.<\/p>\n The operation is run by CISA\u2019s Attack Surface Evaluation team, a unit that conducts security assessments and simulated attacks across the federal government. Two of Reuters\u2019 sources said the audits have already turned up a large number of vulnerabilities. The exact scope, which agencies were covered, and how serious the bugs are have not been disclosed.<\/p>\n Mythos is Anthropic\u2019s most capable model and it isn\u2019t something you can access through a standard subscription. It was described, when Anthropic privately released it to select government partners, as exceptionally capable at finding and exploiting security vulnerabilities. As Reuters reported: <\/p>\n \u201cThe Cybersecurity and Infrastructure Security Agency is using Mythos to scan \u200bgovernment code repositories for bugs that could leave the door open for foreign spies and cybercriminals, \u200bthe sources said.\u201d states Reuters<\/a>. <\/p>\n The NSA has been using the same model since at least April, according to Axios, and NSA analysts testing it in classified settings came away impressed.<\/p>\n The company\u2019s relationship with the U.S. government turned hostile in February when Anthropic refused to remove safeguards that prevented Mythos from being used for autonomous weapons or domestic surveillance. <\/p>\n The Pentagon responded by designating Anthropic as a supply-chain security risk<\/a>, a label that had previously been applied only to foreign companies suspected of facilitating espionage. It was an extraordinary move against a domestic company, and it reflected how seriously the administration took Anthropic\u2019s refusal.<\/p>\n A federal judge blocked the blacklisting in March. Relations began thawing after that, and the CISA deployment is a sign of how much the dynamic has shifted. <\/p>\n \u201cThe \u200bextraordinary blacklisting was\u00a0blocked by \u200ba judge in March<\/a>, and\u00a0the \u2060conflict has eased<\/a>\u00a0following the private release of Anthropic\u2019s Mythos, an AI model described as extremely capable at finding and exploiting cybersecurity vulnerabilities.\u201d continues Reuters.<\/p>\n Giving the government access to the most capable version of the tool appears to have done more to repair the relationship than any amount of negotiation.<\/p>\n When Anthropic launched Fable<\/a> in early June, described as a public version of Mythos with cybersecurity safeguards added, the White House responded by demanding that the company ban foreign nationals from running it. That demand led to a temporary global shutdown of the model. It was lifted only last week, after what Reuters described as a standoff that illustrated how differently the administration treats the private and public deployments of the same underlying technology.<\/p>\n The pattern is now clear: Mythos in government hands, scanning classified systems and federal code, gets quiet approval and active deployment. Mythos in public hands, accessible to anyone including foreign users, immediately triggers national security concerns and regulatory pressure. As Reuters noted on the timeline of events: <\/p>\n \u201cwhen Anthropic rolled out a public version of Mythos called\u00a0Fable<\/a>, \u2060which included \u200bwhat it described as cybersecurity safeguards, the White House suddenly demanded \u200bthat it ban foreigners from running it. This\u00a0triggered a global shutdown of the model<\/a>\u00a0that was\u00a0lifted only last week<\/a>.\u201d continues the agency.<\/p>\n Anthropic has confidentially filed for a U.S. IPO. Having CISA, the NSA, and potentially other agencies actively deploying your most capable model is a materially different position than being on a Pentagon blacklist, and the company got from one to the other in under five months. <\/p>\n A late-June AP report added another data point: a U.S. official said Mythos had identified vulnerabilities in highly sensitive government systems during a testing exercise, which is exactly the kind of result that makes agencies want to expand the program rather than wind it down. <\/p>\n Senate testimony claimed<\/a> Anthropic\u2019s Mythos AI breached NSA and Cyber Command systems in hours, prompting a U.S.-ordered shutdown.<\/p>\n According to a\u00a0report<\/a>\u00a0by The Economist citing a Senate Intelligence Committee hearing, Anthropic\u2019s Mythos model had penetrated nearly all classified systems managed by the NSA and US Cyber Command. Senator Mark Warner stated on June 11 that General Joshua Rudd, who leads both agencies, told him directly that Mythos had done it, and not in weeks.<\/p>\n \u201cEncryption was a potent technology, but narrow in its application. AI is far more powerful and versatile. On June 11th Mark Warner, the vice-chair of the Senate Intelligence Committee, said that General Joshua Rudd, who leads the National Security Agency and the Pentagon\u2019s Cyber Command, had told him that\u00a0Mythos \u201cbroke into almost all of our classified systems, not in weeks, but in hours\u201d.\u201dreported The Economist.<\/p>\n The number of vulnerabilities found so far hasn\u2019t been disclosed, but two sources described it as large.<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n Pierluigi\u00a0Paganini<\/a><\/p>\n (SecurityAffairs<\/a>\u00a0\u2013\u00a0hacking,\u00a0Mythos)<\/p>\n \t\t\t\t\t\t\t\t\t\t\t