NSA Expands Use of Anthropic's Mythos AI Despite Supply Chain Risk Designation

This situation underscores the tension between national security needs and corporate responsibility in AI deployment.

• April 19, 2026: The NSA expands its use of Anthropic's Mythos Preview AI, despite the Pentagon's supply chain risk designation.
• March 2026: The Pentagon formally designates Anthropic as a supply chain risk, initiating a 180-day off-ramp for its removal from DoD systems.
• Ongoing negotiations: The White House is in talks with Anthropic for broader federal access to Mythos, amid tensions over safety guardrails.

• Mythos Preview's capabilities: Developed under Project Glasswing, this AI model can autonomously identify and exploit software vulnerabilities, including long-standing flaws in major operating systems.
• Corporate pushback: Anthropic's refusal to disable safety features has led to legal actions against the Department of Defense, citing First Amendment rights.
• Inter-agency tensions: The NSA's continued use of Mythos highlights a rift between the agency and the Pentagon, as well as the Trump administration's interest in leveraging the AI for national security.

The NSA's decision to continue using Anthropic's Mythos Preview AI, despite the Pentagon's supply chain risk designation, reveals a complex interplay of national security priorities, corporate ethics, and regulatory challenges. The Pentagon's designation of Anthropic as a supply chain risk was unprecedented, marking a significant moment in the relationship between government and tech firms. This designation was prompted by Anthropic's refusal to comply with requests to disable safety guardrails on its AI tools, which the company argued were essential to prevent misuse in mass surveillance and autonomous weaponry.

The Mythos Preview AI has demonstrated exceptional capabilities in cybersecurity, particularly in identifying zero-day vulnerabilities—flaws that are unknown to the software vendor and can be exploited by malicious actors. This has made it an attractive tool for the NSA, which is tasked with protecting national security interests. However, the Pentagon's concerns about Anthropic's commitment to safety and ethical AI deployment have led to a standoff, with the Department of Defense initiating a 180-day off-ramp for the removal of Anthropic's tools from its systems.

The ongoing negotiations between the White House and Anthropic reflect a broader struggle within the U.S. government to balance the urgent need for advanced cybersecurity tools against the risks posed by unregulated AI. The Trump administration's interest in collaborating with Anthropic indicates a willingness to overlook certain regulatory concerns in favor of enhancing national security capabilities. This situation is further complicated by the legal actions Anthropic has taken against the DoD, alleging violations of its First Amendment rights.

As the NSA continues to utilize Mythos, approximately 40 select organizations, including the agency, have been granted access to this powerful AI tool. This raises questions about the implications for cybersecurity across various sectors, particularly as the technology becomes more widely adopted. The cybersecurity community is closely monitoring these developments, anticipating a potential shift in vulnerability management practices and the overall landscape of AI governance.

• Cybersecurity professionals: Increased scrutiny on vulnerability management and ethical AI practices.
• Tech policy makers: Need to navigate the complexities of AI regulation and national security.
• Financial services sector: Potential heightened cyber risks due to Mythos's capabilities, especially in legacy systems.
• Government agencies: Ongoing negotiations may affect access to advanced cybersecurity tools across various departments.

• Legal outcomes: Watch for developments in Anthropic's lawsuits against the DoD, which could set precedents for corporate rights in AI governance.
• Inter-agency agreements: Monitor negotiations between the White House and Anthropic for expanded access to Mythos, which could influence federal cybersecurity strategies.
• Cybersecurity incidents: Keep an eye on any significant breaches or vulnerabilities that may arise, particularly involving legacy systems, as the implications of Mythos's capabilities unfold.