CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws

The audits are reportedly being spearheaded by CISA’s Attack Surface Evaluation team, a specialized unit tasked with conducting digital defense assessments and simulated hacking exercises. The post CISA Reportedly Using Anthropic’s Mythos to Scan Government Software for Flaws appeared first on SecurityWeek .

According to Reuters and SecurityWeek, CISA’s Attack Surface Evaluation team is reportedly using Anthropic’s Mythos AI model to scan federal government code repositories for security vulnerabilities, uncovering a large number of flaws in government software.[1][3][5] Mythos is a highly capable cyber model that can autonomously discover and exploit vulnerabilities in networks and software, significantly exceeding prior models in exploit generation and attack success rates.[4][6] From a RealGround perspective, this creates an AI supply chain risk: federal agencies now depend on a third‑party offensive‑capable AI model for core security operations, raising questions about access control, telemetry, misuse prevention, and contingency plans if the model is disrupted or abused.[4][6] Agencies adopting Mythos should undergo an AI security readiness assessment and supply‑chain/SBOM advisory review to ensure contracts, controls, and monitoring explicitly address model capabilities, responsible disclosure workflows, and safeguards against unintended data exposure or offensive misuse.