Anthropic’s Mythos Preview has turned an advanced cybersecurity model into an issue of US government access and national strategy. The system can autonomously identify and exploit software vulnerabilities, a dual-use capability powerful enough that Anthropic restricted it to selected organisations through Project Glasswing rather than releasing it publicly.
The model’s results have also reopened dialogue between Anthropic and the White House after a sharp procurement dispute. Chief executive Dario Amodei met White House Chief of Staff Susie Wiles with Treasury Secretary Scott Bessent present, as civilian agencies explored access to Mythos for critical-infrastructure defence.
The situation shows how a model considered too risky for broad release can become too valuable for government to ignore.
Mythos finds vulnerabilities missed for years
Mythos was not trained specifically as a security model. Its ability emerged from improvements in general reasoning and code. During Anthropic’s internal testing, it found thousands of previously unknown high-severity vulnerabilities across major operating systems and browsers.
Examples included a 27-year-old OpenBSD bug and a 16-year-old FFmpeg flaw that had survived five million automated tests. Such discoveries demonstrate how AI can search unfamiliar attack surfaces at a scale human teams cannot easily match.
Project Glasswing gives controlled access to organisations including AWS, Apple, Cisco, Google, Microsoft, Nvidia, CrowdStrike and JPMorganChase, supported by up to $100 million in use credits. The purpose is defensive but offensive in method: find exploitable weaknesses before hostile actors do.
US intelligence agencies and the Cybersecurity and Infrastructure Security Agency are already testing Mythos, while Treasury has expressed interest. Civilian departments responsible for financial systems and energy infrastructure see a direct need to assess vulnerabilities before similar capabilities spread.
Cyber capability changes a political standoff
The White House meeting followed an extraordinary conflict. The administration had designated Anthropic a supply-chain risk and stated that it would stop doing business with the company. A federal judge in San Francisco blocked enforcement for non-military agencies while litigation continues.
The Pentagon dispute remains unresolved. Anthropic is barred from Department of Defense contracts under the contested action, even as the department reportedly continues using Claude models in the war with Iran.
The new dialogue aims to separate the military procurement fight from access by other government departments. The Office of Management and Budget is preparing to let agencies use Mythos to assess their defences, according to the source.
Anthropic has also hired Ballard Partners for advocacy related to defence procurement. The developments illustrate how access to exceptional AI capability can reshape relationships between a technology provider and the state even before the legal conflict is settled.
Dual-use governance cannot rely on secrecy forever
Restricted distribution reduces immediate misuse, but it does not resolve the underlying problem. Other models will acquire similar vulnerability-discovery capability, and criminal groups will attempt to use them against financial, energy and government systems.
Defenders therefore need early access, coordinated disclosure and enough resources to fix weaknesses faster than attackers can exploit them. Project Glasswing creates one model for that coordination, but participation criteria and accountability need to remain clear.
Mythos also raises questions about concentration. A private company decides which institutions can use a capability relevant to national infrastructure, while government procurement decisions can determine whether agencies receive the strongest available defence.
Technical controls should include monitored environments, identity verification, detailed activity logs and restrictions on exploit deployment. Governance must distinguish research that confirms a vulnerability from action that could damage a live system.
Amodei’s White House visit does not settle the conflict with the Pentagon. It reveals a more durable reality: governments may disagree with an AI company’s policies while depending on its models for security.
As general systems gain stronger cyber abilities, access decisions will become part of national resilience. The challenge is to use those capabilities quickly enough to strengthen defences without normalising uncontrolled automated exploitation. Mythos is an early test of whether institutions can manage that tension before the tools become widely available.
