US CISA uses Anthropic's Mythos AI to audit government code

The US Cybersecurity and Infrastructure Security Agency (CISA) is using Anthropic's Mythos AI model to scan government code for security flaws that could be exploited by foreign spies or hackers. The work is done by CISA's attack surface assessment team, which runs digital security tests and simulated attacks for government agencies.

Two people familiar with the matter say the audit has found many security holes, but no details were shared. Mythos is known for being very good at finding and using cybersecurity weaknesses. Even though Anthropic has had a rocky relationship with the US government—including being labeled a supply chain risk by the Pentagon in February after refusing to remove safety features from its AI—the model is still being used by intelligence agencies.

The US National Security Agency started using Mythos back in April, and analysts were impressed with its performance in secure tests. But when Anthropic released a public version called Fable, the White House asked to block foreign users, which took the model offline globally until last week.