Sources: CISA's Attack Surface Evaluation team is using Mythos to audit government code repositories and has already uncovered a large number of vulnerabilities
The U.S. cyber defense agency CISA is using Anthropic's AI model Mythos to audit government software, three people familiar …
Context & Ripple Effects
Related coverage shows Mythos moving through U.S. national-security and civilian cyber agencies: the NSA tested it against Microsoft and other widely used software, while the Defense Department said it was deploying it to find and patch vulnerabilities across government systems.
CISA’s reported use extends that pattern into repository-level audits. It also follows earlier reporting that CISA lacked access to Mythos Preview, making operational access by its Attack Surface Evaluation team a meaningful shift in the tool’s government role.
First-order effects
- CISA’s Attack Surface Evaluation team can use Mythos to identify vulnerabilities across government code repositories, creating a larger queue of findings for agency owners to validate and remediate.
- Anthropic gains another reported operational government deployment for Mythos, beyond testing or model-performance claims.
Second-order effects
- The volume of findings can shift the bottleneck from discovery to triage, patching, and coordination among the agencies responsible for affected code.
- Other government cyber teams will face pressure to evaluate comparable AI-assisted code-auditing workflows as DOD, NSA, and CISA activity accumulates around Mythos.
Third-order effects
- If these deployments consistently produce actionable findings, AI-assisted vulnerability discovery could become a standard layer of public-sector software assurance rather than a specialist testing capability.
- The shift would make governance around access to powerful security models, validation of their findings, and responsible remediation increasingly central to government AI procurement.
The trend: This is one data point in the operationalization of frontier AI models as vulnerability-discovery infrastructure across U.S. government cybersecurity organizations.