CISA Is Using Anthropic's Mythos Model to Audit US Government Code

The US Cybersecurity and Infrastructure Security Agency (CISA) is using a closed, offensive-class AI model from Anthropic called Mythos to look for vulnerabilities in government agencies' software. Three sources familiar with the matter described the effort, though almost nothing about the work itself has been officially confirmed.

What we know about how Mythos is being used

The federal agency responsible for protecting US civilian infrastructure is pointing a private, offensive-class AI model at audits of its own government software. In this context, an "offensive" model is a tool built or adapted from the outset for offensive cybersecurity work, meaning finding and exploiting vulnerabilities rather than only passively detecting them.

• The model is called Mythos and belongs to Anthropic
• It is being used by the US Cybersecurity and Infrastructure Security Agency (CISA)
• The goal is to find bugs and vulnerabilities in software used by government agencies
• The information comes from three sources familiar with the matter
• Almost nothing about the work has been officially confirmed or publicly documented

Why the secrecy around the project matters

The fact that almost nothing about Mythos's work inside CISA is publicly available is telling in itself. When government agencies use advanced AI models for offensive cybersecurity, details are deliberately withheld, because publishing the methods and audit results could give potential adversaries hints about vulnerabilities or about the tool's capabilities. The use of a closed, commercially available model from a private company, rather than only the agency's in-house tools, also reflects a broader trend: government bodies increasingly rely on frontier-lab models such as Anthropic's for tasks that until recently required the manual work of in-house cybersecurity staff alone.

What this means

Using an Anthropic offensive model to audit government code is a concrete example of language models moving from auxiliary chat tools to tasks with direct consequences for national cybersecurity. It is also a sign that the line between commercial AI development and government defensive operations keeps blurring.