The sources said CISA is employing Mythos to scan government code repositories for programming flaws that could be exploited by foreign intelligence services or cybercriminals. The effort is being carried out by the agency’s Attack Surface Evaluation team, a specialized unit responsible for conducting cybersecurity assessments and offensive security testing across government systems.

According to two of the sources, the AI-assisted reviews have already identified numerous software vulnerabilities. They did not disclose the number, severity or nature of the flaws, and Reuters could not independently determine how much government software had been examined.

Anthropic did not respond to requests for comment. A CISA spokesperson had previously indicated the agency would consider whether it could share information about the initiative but did not respond to subsequent inquiries.

The project reflects increasing government interest in using generative AI for cybersecurity tasks, particularly automated code analysis and vulnerability detection, as agencies seek to strengthen defenses against increasingly sophisticated cyber threats.

The deployment comes after months of strained relations between Anthropic and the U.S. government. The San Francisco-based company, which has confidentially filed for an initial public offering in the United States, faced a major dispute with federal authorities earlier this year after refusing to remove safeguards that prevented its AI systems from being used for autonomous weapons or domestic surveillance.

In February, the Pentagon designated Anthropic as a supply-chain risk, a classification previously associated with foreign firms suspected of enabling espionage. The designation was blocked by a federal judge in March, easing immediate restrictions on the company.

Relations have since improved following the private release of Mythos, an AI model that sources described as highly capable of identifying and exploiting cybersecurity vulnerabilities. The model has attracted interest from U.S. national security agencies seeking advanced tools to test the resilience of government systems.

The National Security Agency (NSA) has also been using Mythos despite the earlier Pentagon designation, according to previous reporting by Axios. The New York Times reported last month that NSA analysts had tested the model in classified environments and were impressed by its cybersecurity capabilities.

Anthropic later introduced a public version of the model, called Fable, which incorporated cybersecurity safeguards. According to previous reporting, the White House subsequently directed the company to prevent foreign users from accessing the system, leading to a temporary global suspension of the model. Access was restored last week.

The NSA and the White House did not immediately respond to requests for comment on Reuters’ report.

The use of AI-powered software auditing tools by CISA underscores the expanding role of artificial intelligence in U.S. cybersecurity operations as federal agencies increasingly integrate advanced machine learning systems into efforts to identify vulnerabilities before they can be exploited by hostile actors.