CISA Uses Anthropic AI to Scan Government Software

The Cybersecurity and Infrastructure Security Agency (CISA) is piloting Anthropic's Mythos AI model to scan federal government software repositories for security vulnerabilities. Managed by the Attack Surface Evaluation team, the initiative seeks to identify flaws that cybercriminals or foreign intelligence agencies could exploit. While the exact scale and severity of the findings remain undisclosed, sources indicate the tool has already uncovered a significant number of bugs.

This deployment follows a period of volatility between Anthropic and the U.S. government. In February 2026, the Pentagon designated Anthropic as a supply-chain risk after the company refused to remove AI safeguards regarding domestic surveillance and autonomous weapons. Although a judge blocked that blacklisting in March, the company subsequently filed a lawsuit against the administration. Separately, the National Security Agency has utilized Mythos in classified settings since April.

Regulatory tensions continued recently when the White House demanded that Anthropic ban foreign users from accessing Fable, a public version of the model. This order triggered a global shutdown of Fable that lasted until last week. Anthropic CFO Mukesh Khanna stated that these government actions could reduce the company's 2026 revenue by multiple billions of dollars. While some experts praise the speed of AI audits on legacy code, others warn that AI-generated code may introduce new vulnerabilities as quickly as Mythos identifies old ones.