CISA Is Running Anthropic's Mythos AI Against Federal Code and Has Already Found Numerous Vulnerabilities

CISA Scans Its Own Code With AI, Finds Vulnerabilities

The Cybersecurity and Infrastructure Security Agency has deployed Anthropic's Mythos AI model to audit federal government code repositories, according to Reuters, which cited three people familiar with the matter. The goal is to surface security holes that foreign intelligence services and cybercriminals could exploit before they do.

The work is being conducted by CISA's Attack Surface Evaluation team, the internal unit responsible for digital security assessments and offensive hacking exercises across government systems. Two of the sources told Reuters the audits have already uncovered a large number of vulnerabilities.

How large, and how serious? Unknown. Reuters could not establish the scope of the code reviewed or the nature and severity of the bugs found. Anthropic declined to comment. A CISA representative said he would look into whether information could be shared, then provided no follow-up, according to Reuters.

From Excluded to Full Access in Two Months

CISA's path to Mythos was not straightforward. When Anthropic first briefed the agency and the Commerce Department on Mythos capabilities in April 2026, CISA was notably left out of the initial access group, which included roughly 50 organizations, according to Crypto Briefing.

By mid-June 2026, CISA had secured full access under Anthropic's Project Glasswing initiative, a program the company built specifically to expand code analysis capabilities across critical infrastructure and government sectors. Project Glasswing had expanded in early June to approximately 150 additional partner organizations across more than 15 countries. CISA's inclusion came shortly after that expansion, per Crypto Briefing.

During testing exercises with intelligence agencies, Mythos reportedly uncovered vulnerabilities in classified systems within hours. The traditional timeline for equivalent manual review is weeks at minimum, according to Crypto Briefing.

Where Mythos Fits in the Anthropic-Washington Standoff

The CISA deployment does not exist in a vacuum. Anthropic's relationship with the federal government has been rocky.

In February 2026, Anthropic refused to remove AI safeguards that the Pentagon argued were incompatible with certain military applications. The Defense Department responded by designating the company a supply-chain risk, according to Devdiscourse. Tensions eased somewhat after the NSA began testing Mythos in April. But the model's contested status with parts of the administration has already produced at least one concrete disruption: the government pushed Anthropic into a temporary global shutdown of the public-facing Fable version of the model over foreign-access concerns. That shutdown has since been lifted, according to Reuters.

The CISA deployment is simultaneously a sign of government enthusiasm for Anthropic's tools and evidence that underlying policy tensions have not been fully resolved.

The Legitimate Concern

Critics of this deployment have raised valid points. A running inventory of unpatched federal vulnerabilities assembled by an AI system whose access and governance arrangements are not publicly disclosed becomes a high-value target. If that list of bugs exists in any form, on any system, it can be stolen. The fact that neither CISA nor Anthropic will describe the security architecture around the audit results is not reassuring. And Project Glasswing's expansion to partner organizations in more than 15 countries means the same model auditing U.S. government code is also accessible to foreign governments and institutions, raising legitimate questions about shared risk that nobody has answered publicly.

These concerns do not mean the deployment is wrong. The federal government's code has vulnerabilities whether CISA looks for them or not, and AI-assisted auditing that finds bugs in hours rather than weeks is a genuine defensive advantage. The NSA's parallel testing and CISA's apparent urgency to get access after initially being excluded suggest the tool is producing results that matter. The concern is not about whether to use the tool, but about whether the governance around the results is rigorous enough. That question has no public answer yet.

What the Numbers Don't Tell Us

Crypto Briefing's framing—that CISA moved from excluded to demanding full access because preliminary testing was so compelling—is plausible but partially inferential. The sources cited by Reuters confirm that vulnerabilities have been found. They do not confirm severity or confirm that the results drove CISA's access request specifically.

What Comes Next

The open question with direct consequences is what happens to the vulnerabilities already found. CISA has not announced a remediation timeline, a disclosure framework, or a mechanism for notifying the agencies whose code contains the bugs. If the audit is generating a list of unpatched federal security holes and there is no structured process to close them, the exercise produces risk alongside the value it creates. That remediation pipeline, not the AI model itself, is where the real operational accountability lies.