NSA deploys Anthropic Mythos for cyber operations

🔑 Enhanced Key Takeaways

•The NSA's deployment of Anthropic's Mythos LLM is occurring amidst a legal dispute where Anthropic refused the Pentagon's demand to remove contractual limitations on using its AI models for mass domestic surveillance or fully autonomous weapon systems, leading the Pentagon to designate Anthropic as a "supply chain risk."
•Mythos is a frontier AI model specifically designed with strong cybersecurity capabilities, excelling at complex, multi-step cybersecurity tasks, vulnerability identification, and exploit chain construction, and has demonstrated the ability to find thousands of high-severity vulnerabilities, including zero-day flaws, in major operating systems and web browsers.
•Anthropic initially restricted the public release of Mythos, making it available only to select US-based organizations and as part of "Project Glasswing," a defensive cybersecurity program with a limited set of partners including AWS, Apple, Google, and Microsoft, due to concerns about its powerful cybersecurity skills being misused.
•The NSA's use of Mythos is part of a broader trend where adversaries are also leveraging AI for cyber operations, including video phishing, voice exploitation, and identifying vulnerabilities, making AI security a critical national security concern.
•The NSA's Artificial Intelligence Security Center (AISC) is actively working to defend the nation's AI through collaboration with industry, academia, and government partners, and is developing a classified benchmarking process to assess the advanced cyber capabilities of AI models.

📊 Competitor Analysis▸ Show

Feature/Benchmark	Anthropic Mythos	OpenAI GPT-5.4-Cyber	Google Big Sleep
Cybersecurity Capability (CyberGym)	83.1%	81.8% (close to Mythos)	Comparable capabilities
SWE-bench Pro (Resolving GitHub Issues)	77.8%	58.6%	Not specified
Exploit Generation (Firefox targets, safeguards off)	70.8% working exploits	Not specified	Not specified
Kernel Exploitation (ExploitGym)	12 working exploits	22 working exploits	Not specified
Expert Cyber Tasks (UK AI Security Institute)	68.6%	71.4%	Not specified
Cost (per million tokens)	$25 input / $125 output (Preview pricing)	Not specified	Not specified
Access Model	Restricted (Project Glasswing, select partners)	Defender-permissive variant for verified security teams	Not specified

🛠️ Technical Deep Dive

Claude Mythos Preview is a frontier AI model, representing a significant leap in capabilities beyond previous Anthropic models like Claude Opus 4.6.
It excels in software engineering, reasoning, computer use, knowledge work, and research assistance.
Key capabilities include enhanced agent workflows for autonomous multi-step tasks, improved tool usage accuracy, and stability for long-running operations.
It possesses advanced vulnerability discovery and security analysis capabilities, such as code security auditing, attack surface analysis, zero-day vulnerability identification, and security architecture assessment.
Mythos can construct exploit chains by reasoning about and combining multiple attack primitives into working exploits.
The model can generate proofs of exploitability by writing and compiling code to trigger suspected bugs in a scratch environment, then adjusting its approach based on failures.
It has a fundamentally different architecture from its predecessors, contributing to its advanced capabilities.
In cybersecurity benchmarks, Mythos scored 83.1% on CyberGym, significantly outperforming Claude Opus 4.6 at 66.6%.
On SWE-bench Pro, which tests a model's ability to resolve real GitHub issues, Mythos achieved 77.8% compared to Opus 4.6's 53.4%.
Internal evaluations by Anthropic showed Mythos producing full working exploits on 70.8% of Firefox targets when safeguards were off, compared to 8.8% for Opus 4.8.
Anthropic maintains that Mythos's enhanced cybersecurity capabilities reflect improved reasoning about security, and its policies prohibit the model from assisting with genuinely harmful attacks.

🔮 Future ImplicationsAI analysis grounded in cited sources

The ongoing dispute between Anthropic and the Pentagon over AI usage guardrails will significantly influence future government-AI industry partnerships.

Anthropic's refusal to remove restrictions on autonomous weapons and mass surveillance, leading to its 'supply chain risk' designation, sets a precedent for how AI companies might navigate ethical concerns versus national security demands.

The deployment of advanced AI like Mythos by national security agencies will accelerate an AI arms race in cyber warfare.

The demonstrated capabilities of Mythos in vulnerability discovery and exploit generation, coupled with adversaries also using AI for cyber operations, will likely drive other nations and entities to develop or acquire similar advanced AI tools for both offensive and defensive purposes.

Increased reliance on AI for cyber operations will necessitate a rapid evolution of AI security protocols and regulatory frameworks.

The power of models like Mythos to autonomously find and exploit vulnerabilities highlights the critical need for robust AI security measures, classified benchmarking, and potentially new governance models to prevent misuse and ensure responsible deployment.

⏳ Timeline

2021-01

Anthropic founded by former OpenAI researchers focused on AI safety.

2023-03

Anthropic launches Claude, its AI assistant.

2024-03

Anthropic launches the Claude 3 model family (Haiku, Sonnet, and Opus).

2025-07

The U.S. Department of Defense (DOD) awards Anthropic a two-year prototype agreement with a $200 million ceiling.

2026-02

Anthropic refuses DOD's demand to remove prohibitions on using Claude for autonomous weaponry or domestic mass surveillance.

2026-03

The Pentagon designates Anthropic a "supply-chain risk to national security"; Anthropic challenges the decision.

2026-04

Anthropic officially unveils Claude Mythos, initially restricting access to select partners under "Project Glasswing" due to its powerful cybersecurity capabilities.

2026-04

The NSA is reported to be using Anthropic's Mythos Preview despite the DOD's "supply chain risk" designation.

2026-06

President Donald Trump signs an executive order creating a "voluntary framework" for government oversight of cutting-edge AI, with the NSA playing a central role in classified benchmarking.