US cyber agency CISA uses Anthropic’s Mythos to audit government software

The US Cybersecurity and Infrastructure Security Agency (CISA) is now employing Anthropic’s advanced AI model, Mythos, to scrutinize government software for potential security vulnerabilities. This initiative highlights the increasing reliance on Anthropic's innovative tools by US security organizations, despite the company's ongoing challenges with the federal government, particularly the White House and the Pentagon. According to sources cited by Reuters, CISA is utilizing Mythos to audit code repositories within the government, seeking out weaknesses that could be targeted by foreign intelligence entities or cybercriminals. The audits are conducted by CISA’s Attack Surface Evaluation team, which specializes in cybersecurity evaluations and simulated cyberattacks across various government branches. Insider information suggests that these audits have already revealed a significant number of vulnerabilities, though specifics regarding the severity of these issues or the agencies involved have not been disclosed. A representative from CISA previously indicated that they would provide updates on the situation but did not respond to further inquiries. The adoption of Mythos comes amid a backdrop of a complex relationship between Anthropic and the US government. The AI startup, which is in the process of confidentially filing for an initial public offering, encountered significant friction with the administration earlier this year after refusing to eliminate safeguards that restrict the application of its models in autonomous weaponry and domestic surveillance. In a notable development, the Pentagon classified Anthropic as a formal supply-chain risk, a designation typically reserved for foreign companies suspected of espionage activities. However, a US judge overturned this classification in March. Since then, tensions have subsided, especially following the private launch of Mythos, which has been recognized for its impressive ability to detect and exploit cybersecurity vulnerabilities. Additionally, the National Security Agency (NSA) has reportedly been utilizing Mythos since at least April, with analysts expressing admiration for its performance in classified settings. However, the relationship faced renewed scrutiny when Anthropic launched a public version of Mythos, known as Fable, which incorporated cybersecurity safeguards. In response, the White House mandated that Anthropic restrict access to the model for foreign nationals, leading to a temporary global shutdown of Fable that was only recently lifted.