US cybersecurity agency is reportedly using Anthropic's Mythos for auditing govt code. What does it mean?

The US Cybersecurity and Infrastructure Security Agency (CISA), is using Anthropic's AI model Mythos to audit government software, Reuters has reported, citing three people familiar with the matter. This is interesting given the tussles between the Trump administration and Anthropic, the firm behind the popular Claude AI models. CISA is using Mythos to scan government code repositories for bugs that could leave the door open for foreign spies and cybercriminals, according to the report.

Why is the US government using Anthropic's coding agent significant? The political irony

It's interesting that the agency is using the controversial Mythos, not the regular Claude model for the audit, as per the report. Mythos has demonstrated the ability to find, exploit and fix cybersecurity vulnerabilities, including those in the financial and banking sectors. Upon its release, Mythos was immediately restricted for use only by approved organisations. The political irony is not lost on anyone. Just three months ago, the Pentagon had slapped Anthropic with a supply-chain risk designation. A judge later blocked the blacklisting in March. Mythos has not yet been released to the public.

Axios, meanwhile, had reported that the US intelligence agency, the National Security Agency (NSA), had been using Mythos as of April despite the blacklist. The New York Times reported in late June that NSA analysts testing it in classified settings were impressed by its performance.

In short, the US security establishment is quietly embracing the very company that the Trump administration had tried to blacklist.

Which websites are included for Anthropic code-checking?

The Reuters report said the Anthropic AI model would be used for auditing government code repositories, not websites as such. The task is being carried out by CISA's Attack Surface Evaluation (ASE) team, which conducts digital security assessments and authorised hacking exercises across government systems. It is not clear exactly how much government code the team has reviewed or the nature and severity of the vulnerabilities it has discovered. Nor have CISA or Anthropic disclosed which government departments or websites are included in the programme.

Finance, business and economy relevance

The ASE team works across the federal government. Therefore, it would be reasonable to assume that systems operated by the Department of the Treasury, the Securities and Exchange Commission (SEC), the Internal Revenue Service (IRS) and the Department of Commerce could potentially fall within the scope of these audits, although the Reuters story does not specifically mention any of these agencies. Notably, in February, the Treasury, State and Health and Human Services Departments issued statements confirming compliance with the government directive at the time to phase out Anthropic tools following government order.

Is the US government admitting that its code needs fixing?

The sources cited by Reuters said the audits had already uncovered a large number of vulnerabilities. However, this should not be interpreted as an admission that government software is fundamentally broken. Large organisations routinely conduct code audits because legacy software, outdated libraries and coding errors inevitably accumulate over time. AI is now making it significantly easier to identify bugs and security vulnerabilities in large volumes of legacy code at scale, allowing agencies to fix weaknesses before they can be exploited by foreign adversaries or cybercriminals.