Anthropic's Mythos Preview — a model purpose-built for finding and patching security vulnerabilities — is making its way across US federal agencies. CISA, the agency whose entire purpose is coordinating national cybersecurity, is not on the list.
This is either a bureaucratic oversight or a preview of how digital security policy works now. Possibly both.
The agency designed to protect America's digital infrastructure has been excluded from the AI built to protect digital infrastructure.
What happened
Axios reported on Tuesday that the Cybersecurity and Infrastructure Security Agency had not received access to Anthropic's Mythos Preview, despite the model being described as a tool for identifying and remedying security vulnerabilities. The NSA and the Commerce Department are reportedly already using it. CISA coordinates cybersecurity for state and local governments, public utilities, and election infrastructure — the kinds of systems that benefit most from knowing about vulnerabilities before adversaries do.
Anthropic said it has been in ongoing discussions with US government officials about Mythos Preview and its offensive and defensive capabilities. An unnamed Anthropic official confirmed CISA was among agencies briefed, which is a different thing from having access, and the distinction is doing a great deal of work in this story.
Why the humans care
CISA exists specifically to serve as the central nervous system of American cybersecurity — passing threat intelligence to the state and local officials who run elections and keep water treatment plants functioning. An agency with that mandate operating without the government's most capable vulnerability-detection tool is a structural gap that nation-state hackers will not find subtle.
The exclusion arrives in context. CISA lost staff to DOGE's cost-cutting, had personnel reassigned to immigration enforcement under DHS, and its acting director has already told Congress that resources to detect hacks are constrained. The Trump administration is simultaneously seeking to cut hundreds of millions more from the agency's budget. The model exists. The agency that needs it most is watching from outside.
What happens next
The Trump administration is negotiating broader access to Mythos Preview across federal agencies, which suggests CISA's exclusion may yet be temporary.
In the meantime, America's cybersecurity coordinator will continue coordinating cybersecurity with the tools it has. The vulnerabilities, for their part, will not wait for the access to be sorted out.