US cyber agency uses Anthropic's Mythos to hunt for government code flaws
AI is moving deeper into government cybersecurity, with CISA using Anthropic’s powerful model to uncover hidden software flaws.
Image by Shutterstock.
- US cyber agency CISA is using Anthropic’s Mythos AI to scan government code for security vulnerabilities, sources say.
- The tool is designed to find software flaws that could be exploited by hackers, including foreign cyber groups.
- Sources say audits have already uncovered many vulnerabilities, but details about the flaws remain undisclosed.
- The move highlights growing US government interest in AI cybersecurity tools despite tensions between Anthropic and officials.
The US cyber defense agency CISA is using Anthropic's AI model Mythos to audit government software, three people familiar with the matter said on Monday, another sign of government enthusiasm for adopting the AI startup's tools even as the company navigates an ongoing standoff with the White House.
The Cybersecurity and Infrastructure Security Agency is using Mythos to scan government code repositories for bugs that could leave the door open for foreign spies and cybercriminals, the sources said.
Anthropic did not respond to questions about the initiative. A CISA representative said last month that he would check to see if there was anything to share about the matter but did not respond to further emails.
The scanning is being done by CISA's Attack Surface Evaluation team, according to one of the sources. The team is a group within CISA that conducts digital security assessments and hacking exercises across government.
More from Cybernews
Sainsbury’s installs more facial rec tech in stores: Should shoppers be worried?
"Phantom squatting” uses AI hallucinated domains for cyber attacks
What they’re doing to gamers is a robbery in broad daylight
Irish parliament expands Microsoft use, despite the EU’s efforts to ditch it
Can government AI actually scrub UAP footage from the internet?
The EU and Apple CEO Tim Cook held "constructive" talks after their Siri AI dispute in Europe
Two of the sources said the audits had already uncovered a large number of vulnerabilities but did not elaborate. Reuters could not establish exactly how much government code the team had gone through or the nature or severity of the bugs it discovered.
Anthropic’s government fight takes a surprising turn
Anthropic, which has confidentially filed for a US initial public offering, has had a tumultuous relationship with the US government. Relations reached a nadir in February after the San Francisco-based company refused to remove safeguards that prevented its AI from being used for autonomous weapons or domestic surveillance. That prompted the Pentagon to slap it with a formal supply-chain risk designation, a label heretofore applied to foreign companies suspected of facilitating espionage.
The extraordinary blacklisting was blocked by a judge in March, and the conflict has eased following the private release of Anthropic's Mythos, an AI model described as extremely capable at finding and exploiting cybersecurity vulnerabilities.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
The National Security Agency, the US government's powerful eavesdropping agency, has been using Mythos as far back as April despite the blacklist, Axios has reported. Late last month, the New York Times said that NSA analysts had been testing Mythos in classified settings and coming away impressed with its capabilities. But when Anthropic rolled out a public version of Mythos called Fable, which included what it described as cybersecurity safeguards, the White House suddenly demanded that it ban foreigners from running it. This triggered a global shutdown of the model that was lifted only last week.
The NSA and the White House did not immediately respond to requests for comment.