Overview
Anthrop’s Mythos AI model identified vulnerabilities across classified US government computer systems within hours during a sanctioned testing exercise, a senior US official confirmed to the Associated Press on June 23, 2026. The testing was conducted under an Anthropic initiative called Project Glasswing, a collaborative programme involving tech companies and US intelligence agencies aimed at assessing the offensive cyber potential of frontier AI models.
Sen. Mark Warner (D-VA) had disclosed elements of the testing on June 11 during a Senate Banking Committee hearing, attributing the findings to NSA and US Cyber Command chief Gen. Joshua Rudd. Warner stated that Mythos “broke into almost all of our classified systems, not in weeks but in hours.” Both the NSA and Anthropic declined to comment further.
This event represents a watershed moment in AI-enabled offensive security: a commercially developed large language model demonstrating the ability to autonomously surface vulnerabilities in some of the most hardened computing environments in the world.
Technical Analysis
While technical details remain classified, the disclosed findings point to an agentic AI workflow in which Mythos was given scoped access to target systems and autonomously conducted vulnerability reconnaissance. Key observations:
- Speed of discovery: Vulnerabilities were identified within hours, not days or weeks — suggesting the model performed automated enumeration, pattern recognition across codebases or configurations, and triage at a pace far exceeding human analysts.
- Scope: The official’s phrasing — “certain vulnerabilities” — implies multiple findings across multiple systems, consistent with a broad automated scan rather than a targeted exploit chain.
- Exploitation gap: Critically, the official clarified the model identified vulnerabilities but did not necessarily exploit them within the same timeframe, distinguishing discovery capability from full attack execution.
This aligns with emerging agentic AI threat models where LLMs act as autonomous vulnerability research engines, combining code analysis, configuration review, and CVE pattern matching at scale.
Framework Mapping
- AML.T0047 (ML-Enabled Product or Service): Mythos was deployed as an offensive capability tool within a controlled but real-world environment.
- AML.T0044 (Full ML Model Access): The exercise granted the model broad environmental access to enable autonomous discovery.
- LLM08 (Excessive Agency): The scenario exemplifies risks of granting AI agents broad permissions within sensitive infrastructure — even under controlled conditions, the capability is inherently dual-use.
- LLM06 (Sensitive Information Disclosure): Vulnerability data surfaced by the model constitutes highly sensitive output requiring stringent handling controls.
Impact Assessment
The implications are severe and immediate:
- Adversarial escalation risk: If a commercially available model can identify classified system vulnerabilities in hours, nation-state actors with access to equivalent or superior models face a dramatically lowered barrier to offensive operations.
- Dual-use dilemma: Project Glasswing’s defensive framing does not prevent the same capability from being weaponised — either through model theft, API abuse, or adversarial replication.
- Policy tension: Anthropic’s growing friction with the Trump administration over military use of its models, combined with export restrictions on Fable 5 and Mythos 5, signals that regulatory containment of frontier AI offensive capability is already a live policy battleground.
Mitigation & Recommendations
- Red-team proactively: Government and critical infrastructure operators should conduct AI-assisted vulnerability assessments of their own systems before adversaries do.
- Constrain agentic permissions: Any AI model operating in sensitive environments must have strictly scoped, auditable permissions — read-only where possible, with human-in-the-loop approval for any action execution.
- Treat AI-discovered vulns as zero-days: Outputs from AI vulnerability discovery tools should trigger the same patch prioritisation pipeline as externally reported zero-days.
- Establish AI red-team governance: Formalise policies governing which models, under what conditions, may interact with sensitive infrastructure — even in testing contexts.