NSA Runs Mythos While DoD Brands Anthropic a Supply-Chain Risk
Axios: NSA is using Anthropic’s Mythos Preview for defensive cyber (e.g. vuln scanning) even as DoD designates Anthropic an ‘unacceptable supply chain risk’ and pushes contractor bans. Same department, opposite postures — intelligence ops vs procurement politics over ‘all lawful purposes’ access.
U.S. AI governance is not one policy — it is procurement blacklists and intelligence tasking sharing a org chart. The Axios scoop’s frame: the DoD can brand Anthropic a supply-chain risk while the NSA (inside DoD) runs the lab’s most gated cyber model.
Axios (April 19) reported the NSA is actively using Mythos Preview for cybersecurity work such as vulnerability scanning, despite the Department of Defense designating Anthropic an “unacceptable supply chain risk” and seeking to block use across military contractors. Reuters and others confirmed the report. Mythos remains Anthropic-limited to roughly 40 organizations (Project Glasswing defensive cohort with firms like Microsoft and Google among named partners); UK AI Security Institute also cited as having access.
Blacklist vs operations
| Track | Posture (reporting Feb–Apr 2026) |
|---|---|
| DoD designation | Supply-chain risk after contract fights over broader “all lawful purposes” access (surveillance/autonomous weapons concerns in Anthropic’s telling) |
| Court | Temporary block on aspects of the measure (described as “Orwellian” in some coverage) |
| NSA use | Mythos for finding/exploiting vulns in agency systems (sources); some reports of broader DoD use |
| Contractors | Pressure to certify non-use — compliance friction |
Amodei met White House officials (~April 17, including Susie Wiles and Scott Bessent per coverage) on government Mythos use and security practices. DoD argues restrictions prove wartime unreliability; Anthropic argues misuse boundaries.
Claims vs checks
NSA use + blacklist tension is Axios primary (Reuters wire-of-Axios). Mythos capability claims (thousands of vulns, exploit chaining) track Anthropic Glasswing framing. Exact classification of NSA authority vs DoD procurement rules is not litigated to final clarity in this scoop. Treat operational details as sourced journalism, not official confirmation packages.
Limits
- Classification and scope of NSA deployments largely opaque.
- Court posture on the blacklist may shift.
- Contractor certification burden is reported friction, not a published compliance count.
Sources
- Axios: “Scoop: NSA using Anthropic's Mythos despite Defense Department blacklist” (April 19, 2026).
- Reuters: “US security agency is using Anthropic's Mythos despite blacklist, Axios reports” (April 19, 2026).
- TechCrunch, Engadget, and prior DoD designation / Glasswing / contract coverage (February–April 2026).