The Gap Is Real and It's Getting Worse

Since the White House released its 6-pillar cyber strategy, the on-the-ground reality at CISA has deteriorated significantly.

According to Forbes, two current CISA employees confirmed the agency has NO access to advanced AI models from either Anthropic or OpenAI — the two labs that just released the most capable automated hacking tools in history.

One staffer put it bluntly: "We aren't even allowed to say the name Anthropic right now."

A federal employee describing their actual operational environment.

Why Anthropic Is Radioactive Inside CISA

This isn't an accident or a budget problem. According to Forbes, Anthropic got itself labeled a supply chain risk across federal agencies following a dispute with the Department of Defense over its tools being used for surveillance purposes.

Result: Anthropic is effectively banned government-wide.

Timing couldn't be worse. Anthropic just released a model called Mythos, which autonomously discovered software bugs across every major browser and operating system. CISA needs exactly this kind of capability to find vulnerabilities in critical infrastructure BEFORE adversaries do.

Instead, CISA staffers are watching from the sidelines.

OpenAI Is Available. CISA Still Hasn't Plugged In.

OpenAI isn't banned. Its tools ARE accessible to government agencies. OpenAI even launched a program called Trusted Cyber Access specifically for vetted cybersecurity teams — state and federal agencies included — to use advanced AI for finding and fixing software flaws, according to Forbes.

CISA hasn't accessed those tools either.

This isn't purely about the Anthropic dispute. There's a deeper institutional failure here. The agency charged with defending U.S. critical infrastructure apparently can't get its procurement act together fast enough to access tools that commercial hackers — and foreign intelligence services — are already running in the field.

The Enemy Isn't Waiting

Last year, Anthropic itself revealed that Chinese hackers used its Claude model to generate cyberattacks against as many as 30 targets, including government entities, according to Forbes.

China isn't filing procurement paperwork. Criminal hacking groups aren't waiting for inter-agency approval chains.

Meanwhile, The Verge's Hayden Field reported in depth on how AI-enabled autonomous weapons and cyber tools have already moved from hypothetical to operational. The infrastructure is live.

CISA's own website lists a stack of AI security guidance documents — including a May 1, 2026 joint publication with Australia's cyber security center on safely adopting agentic AI systems. The agency is publishing guidance on AI risks it doesn't have the tools to actually address internally.

What CISA IS Doing (On Paper)

CISA has published multiple joint guidance documents in recent months:

• "Careful Adoption of Agentic AI Services" (May 1, 2026) — co-authored with Australia's ASD and international partners
• "Principles for the Secure Integration of AI in Operational Technology" — targeting critical infrastructure operators
• "AI Data Security: Best Practices" — covering data used to train and operate AI systems
• "AI Red Teaming" guidance — on evaluating AI safety and security

These documents are genuinely useful for the private sector.

But guidance papers don't stop a Chinese AI from scanning federal networks for zero-day vulnerabilities at 3 a.m.

What Mainstream Coverage Is Missing

Most coverage on this story frames it as a Trump administration attack on CISA — the hobbling narrative. Staffing cuts and budget pressure on the agency are real.

But the Anthropic ban isn't a Trump culture war move. It grew out of a legitimate dispute about whether Anthropic's tools should be used for military surveillance. That's a real policy question with no easy answer.

The OpenAI gap is harder to explain politically. The tools are available. The program exists. CISA just hasn't accessed them. Few in mainstream coverage are pressing that question hard enough.

What This Means for Critical Infrastructure

Critical infrastructure means the power grid, water systems, hospital networks, financial systems. Those are the targets.

The adversaries attacking them — China's state hackers, ransomware gangs, foreign intelligence services — are using the best available AI tools right now. Today.

CISA, the agency specifically built to defend that infrastructure, is blocked from one major AI vendor by bureaucratic dispute and apparently can't execute procurement fast enough to access the other.

The White House rolled out a polished 6-pillar cyber strategy. Meanwhile the agency that's supposed to execute the strategy can't say a company's name out loud.

Strategies don't defend networks. Tools and trained people do. Right now, America's cyber defenders are working with outdated capabilities while adversaries deploy the latest technology.