NSA tests Anthropic's Mythos model for finding vulnerabilities in Microsoft products

The US NSA is testing Anthropic's new artificial intelligence model Mythos to find vulnerabilities in popular software, including Microsoft products. It is one of the most visible signs that generative models are being used not only to write code but also to audit security at the level of large government bodies.

What is known so far

According to available information, the US National Security Agency is checking how well Anthropic's model can find weak spots in widely used software. Microsoft products are named among the systems covered by the testing.

Details of the project have not been disclosed. It is unknown whether this is an internal pilot, a one-off assessment of the model's capabilities, or a broader process that could become part of ongoing practice. There is also no public data on which classes of bugs the system looks for.

Who is commissioning these checks matters too. If the NSA is experimenting with AI for bug hunting, the technology is being treated not as a lab demo but as a potentially useful tool for real cybersecurity tasks. For the market, this is a strong signal: large organizations are ready to test whether a model can speed up the work of specialists who protect infrastructure and enterprise software. That is especially true where the cost of a missed error is too high.

The combination of Anthropic, Microsoft and the NSA is of particular interest. On one side is a major model developer pushing AI into enterprise and sensitive use cases. On the other is a software ecosystem that underpins a significant share of office, cloud and infrastructure work. When such players come together in one case, it is no longer an experiment for a presentation but a test of practical value in a high-risk environment.

How it could work

In scenarios like this, AI does not replace the security researcher entirely. It helps process large volumes of code, documentation and system dependencies faster. The model can serve as an assistant that proposes hypotheses, flags suspicious sections, helps reproduce chains of errors and indicates where it is worth digging deeper. Final validation stays with a human, especially for critical products. This matters most with old and complex systems.

Microsoft's interest is also telling. Its products underpin a huge number of corporate and government systems, so even minor vulnerabilities in popular products can have a wide impact. If AI can detect such problems earlier than attackers or classic audit cycles, the gain will come not only in speed but in scale: the same model can analyze more components in parallel than a limited team can by hand.

Where defenders benefit

In such projects, models are usually valuable not for a single "magic" feature but as a set of accelerators for the security team. They do not replace manual audits, but they help narrow the scope of review faster, set priorities and turn raw technical signals into clear actions for engineers, analysts and product owners. Such a layer helps when a team has little time for initial triage and too many places where a bug could hide.

• quickly flag potentially risky sections of code and logic
• help match error symptoms to known classes of vulnerabilities
• suggest test scenarios for rare or complex combinations of components
• shorten the time between the first signal and manual re-verification
• help document findings in plain language for developers and analysts

Still, many limitations remain around these tools. A model can wrongly label safe code as dangerous, miss non-standard bugs or offer convincing but incorrect explanations. So the key question is not whether AI "can find vulnerabilities" in general, but how consistently it does so on real products, with an acceptable number of false positives and clear benefit to the team. That is why such systems do not yet work without experts.

What it means

The Mythos story shows that the next stage of AI adoption in cybersecurity is not reference chatbots but practical tools for auditing complex software. If these tests deliver results, large vendors and government bodies will start building models into vulnerability discovery and prioritization processes faster.