The US government is quietly turning to one of the world’s most advanced artificial intelligence systems to strengthen its cyber defences, and the move comes with a dose of political irony.

According to a Reuters report, the US Cybersecurity and Infrastructure Security Agency (CISA) is using Mythos, Anthropic’s unreleased AI coding agent, to audit government software for vulnerabilities that could be exploited by hackers or foreign intelligence agencies. The development is notable because it follows months of tension between the Trump administration and Anthropic, the company behind the Claude family of AI models.

While the administration previously moved to restrict Anthropic over supply-chain security concerns, federal cybersecurity teams now appear to be relying on the company’s most powerful coding AI to protect government systems.

Why Is CISA Using Anthropic’s Mythos?

Reuters, citing three people familiar with the matter, reported that CISA’s Attack Surface Evaluation (ASE) team is deploying Mythos to scan government code repositories for software flaws.

Unlike Anthropic’s publicly available Claude models, Mythos is an unreleased AI system designed specifically for cybersecurity tasks. It can reportedly identify software vulnerabilities, demonstrate how attackers could exploit them, and even suggest or generate fixes.

The goal is straightforward: detect weaknesses before cybercriminals or foreign adversaries find them first.

Rather than manually reviewing millions of lines of code, cybersecurity analysts can use AI to rapidly identify outdated libraries, insecure coding practices, configuration errors, and other vulnerabilities that might otherwise remain hidden.

Why Is This Politically Significant?

The timing makes the story especially striking.

Just a few months ago, the Pentagon reportedly designated Anthropic as a potential supply-chain security risk, effectively blacklisting the company from certain government procurement activities. That designation was later blocked by a federal judge in March.

Despite that dispute, multiple reports now indicate that parts of the US national security apparatus have continued evaluating—or even using—Mythos.

According to Axios, the National Security Agency (NSA) had already been using Mythos in some capacity as of April despite the earlier restrictions.

The New York Times later reported that NSA analysts testing the model in classified environments were impressed by its cybersecurity capabilities.

Taken together, the reports suggest that while policy debates over AI vendors continue, government cybersecurity professionals are prioritizing technical performance when defending critical infrastructure.

What Makes Mythos Different From Claude?

Although Anthropic has publicly released several Claude AI models for general users and businesses, Mythos remains unavailable to the public.

According to reports, the model was built specifically for offensive and defensive cybersecurity work.

Its reported capabilities include the following:

• Finding software vulnerabilities
• Demonstrating how attackers could exploit weaknesses
• Recommending or generating security patches
• Assisting with large-scale code reviews
• Supporting vulnerability assessments across complex software systems

Because of these advanced capabilities, access to Mythos has reportedly been limited to approved organisations rather than being released commercially.

Which Government Systems Are Being Audited?

Reuters reports that Mythos is being used to review government code repositories, not public-facing websites themselves.

The audits are being conducted by CISA’s Attack Surface Evaluation team, which specialises in:

• Authorized penetration testing
• Security assessments
• Vulnerability discovery
• Digital infrastructure evaluations

Neither CISA nor Anthropic has publicly identified which federal agencies are participating.

Reuters also noted that officials have not disclosed the following:

• How much government code has been reviewed
• How many vulnerabilities have been discovered
• Which agencies are involved
• The severity of the identified security flaws

That lack of detail is typical for cybersecurity operations, where revealing specific vulnerabilities could itself create security risks.

Could Financial Agencies Be Included?

The Reuters report does not specifically identify the agencies whose software is being audited.

However, because the Attack Surface Evaluation team works across the federal government, systems may operate by agencies such as:

• The Department of the Treasury
• The Internal Revenue Service (IRS)
• The Securities and Exchange Commission (SEC)
• The Department of Commerce

could eventually fall within the scope of similar security reviews.

This remains speculative, however, as Reuters did not confirm the involvement of any specific department.

Earlier this year, the Treasury Department, State Department, and Department of Health and Human Services all acknowledged complying with government guidance directing agencies to phase out Anthropic tools following the initial procurement restrictions.

Does This Mean US Government Software Is Insecure?

Not necessarily.

The discovery of vulnerabilities during a code audit does not imply that government software is unusually flawed.

Large organisations—including governments, banks, hospitals, and Fortune 500 companies—regularly conduct security reviews because software naturally accumulates technical debt over time.

Common issues include:

• Legacy code
• Unsupported software libraries
• Configuration mistakes
• Coding errors
• Newly discovered vulnerabilities in third-party components

Modern AI systems are increasingly helping security teams review massive codebases much faster than traditional manual methods.

Instead of replacing human cybersecurity experts, AI acts as a force multiplier by highlighting sections of code that deserve closer inspection.

Why AI Is Becoming Essential for Cybersecurity

Government software often spans decades of development and millions of lines of code.

Reviewing that volume manually is both expensive and time-consuming.

AI coding agents can accelerate the process by:

• Scanning entire repositories within hours instead of weeks
• Identifying known vulnerability patterns
• Prioritizing the most critical security risks
• Suggesting code fixes
• Helping analysts focus on higher-risk findings

As cyber threats become more sophisticated—including attacks from nation-state actors—the ability to rapidly identify vulnerabilities has become a strategic advantage.

The Bigger Picture

The reported use of Mythos reflects a broader shift in how governments are approaching artificial intelligence.

Even amid political disagreements over AI companies and procurement policies, agencies responsible for national cybersecurity appear willing to adopt cutting-edge tools when they offer meaningful security benefits.

Whether Mythos eventually becomes publicly available remains unclear. But its reported deployment inside US government cybersecurity operations suggests that AI-powered code auditing is rapidly moving from experimental technology to an important part of national cyber defence.