# NSA Runs Mythos While DoD Brands Anthropic a Supply-Chain Risk

Times of AI Desk · 2026-04-19 · Policy

[https://timesof.ai/2026/04/nsa-using-anthropic-mythos-despite-pentagon-blacklist](https://timesof.ai/2026/04/nsa-using-anthropic-mythos-despite-pentagon-blacklist)

> Axios: NSA is using Anthropic’s Mythos Preview for defensive cyber (e.g. vuln scanning) even as DoD designates Anthropic an ‘unacceptable supply chain risk’ and pushes contractor bans. Same department, opposite postures — intelligence ops vs procurement politics over ‘all lawful purposes’ access.

U.S. AI governance is not one policy — it is **procurement blacklists and intelligence tasking sharing a org chart**. The Axios scoop’s frame: the DoD can brand Anthropic a supply-chain risk while the **NSA (inside DoD)** runs the lab’s most gated cyber model.

**Axios** (April 19) reported the **NSA** is actively using **Mythos Preview** for cybersecurity work such as vulnerability scanning, despite the **Department of Defense** designating Anthropic an **“unacceptable supply chain risk”** and seeking to block use across military contractors. Reuters and others confirmed the report. Mythos remains Anthropic-limited to roughly **40 organizations** (Project Glasswing defensive cohort with firms like Microsoft and Google among named partners); UK AI Security Institute also cited as having access.

## Blacklist vs operations

| Track | Posture (reporting Feb–Apr 2026) |
|-------|----------------------------------|
| **DoD designation** | Supply-chain risk after contract fights over broader “all lawful purposes” access (surveillance/autonomous weapons concerns in Anthropic’s telling) |
| **Court** | Temporary block on aspects of the measure (described as “Orwellian” in some coverage) |
| **NSA use** | Mythos for finding/exploiting vulns in agency systems (sources); some reports of broader DoD use |
| **Contractors** | Pressure to certify non-use — compliance friction |

Amodei met White House officials (~April 17, including Susie Wiles and Scott Bessent per coverage) on government Mythos use and security practices. DoD argues restrictions prove wartime unreliability; Anthropic argues misuse boundaries.

## Claims vs checks

NSA use + blacklist tension is **Axios primary** (Reuters wire-of-Axios). Mythos capability claims (thousands of vulns, exploit chaining) track **Anthropic Glasswing framing**. Exact classification of NSA authority vs DoD procurement rules is **not litigated to final clarity** in this scoop. Treat operational details as sourced journalism, not official confirmation packages.

## Limits

- Classification and scope of NSA deployments largely opaque.
- Court posture on the blacklist may shift.
- Contractor certification burden is reported friction, not a published compliance count.

## Sources

- [Axios: “Scoop: NSA using Anthropic's Mythos despite Defense Department blacklist”](https://www.axios.com/2026/04/19/nsa-anthropic-mythos-pentagon) (April 19, 2026).
- Reuters: “US security agency is using Anthropic's Mythos despite blacklist, Axios reports” (April 19, 2026).
- TechCrunch, Engadget, and prior DoD designation / Glasswing / contract coverage (February–April 2026).