US cyber agency deploys Anthropic AI to hunt vulnerabilities in government code

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has begun using Anthropic's artificial intelligence model, Mythos, to help identify vulnerabilities in government software, according to a Reuters report citing people familiar with the matter. The move signals continued government adoption of advanced AI tools for cybersecurity, even as Anthropic's relationship with U.S. authorities has faced recent challenges.

Sources told Reuters that CISA is employing the AI model to examine government code repositories for security weaknesses that could potentially be exploited by cybercriminals or foreign intelligence agencies. The work is reportedly being carried out by the agency's Attack Surface Evaluation team, which is responsible for conducting cybersecurity assessments and simulated hacking exercises across federal systems.

According to two of the sources, the AI-assisted reviews have already uncovered numerous software vulnerabilities. However, the report did not specify the number of code repositories analysed or provide details about the severity or type of security flaws identified.

Anthropic did not respond to Reuters' request for comment. CISA also did not provide additional information on the reported initiative.

Also read: Google Brain co-founder Andrew Ng says AI won't replace developers, explains 'loop engineering'

The reported deployment comes after a turbulent period in Anthropic's interactions with the U.S. government. Earlier this year, the company reportedly resisted requests to remove safeguards designed to prevent its AI systems from being used for autonomous weapons or domestic surveillance. That disagreement led to the Pentagon assigning Anthropic a formal supply-chain risk designation, although a U.S. judge later halted the move.

Since then, relations appear to have improved following the private rollout of Mythos, a specialised AI model designed to identify and exploit cybersecurity vulnerabilities for defensive testing. Reuters reported that the model has drawn interest from multiple government agencies.

Earlier reports have indicated that the U.S. National Security Agency (NSA) began evaluating Mythos in classified environments months ago, with analysts reportedly viewing its cybersecurity capabilities favourably.

Anthropic also recently introduced a public version of the model, known as Fable, incorporating additional cybersecurity safeguards. The launch was followed by a temporary suspension of access for international users after the White House reportedly pushed for tighter restrictions. That limitation was lifted last week.