“I hear a lot of people talking about challenges and threats when they talk about Mythos,” Katherine Sutton, the Assistant Secretary for Cyber Policy, told the SCSP AI+Expo. “One of the foundational things that they’re going to enable is the development of secure code.”
Katherine Sutton: secure code in “minutes to seconds”
At the SCSP AI+Expo, Sutton argued that the much‑hyped, unreleased Mythos model — and models like it — represent an opportunity as well as a threat. She said the current defensive posture, which patches vulnerabilities “at human speed, in weeks to days,” is no longer acceptable. By contrast, she said, Mythos and its kin could find and fix bad code in “minutes to seconds.” For Sutton, that shift to much faster remediation is a foundational capability: these models could enable the development of secure code and close long‑standing windows of exposure.
Emil Michael: faster finding, faster patching — and faster exploitation
Emil Michael, the Pentagon’s chief technology officer and Under Secretary for Research and Engineering, echoed Sutton’s optimism while emphasizing the tradeoffs. “Now you can find them faster, and the good news is you can patch them faster,” he said. “The bad news is you can exploit them faster.” Michael described the Defense Department and the nation as relying on “a patchwork of often‑antiquated software systems running sloppy, buggy code,” and suggested AI that can autonomously patch that code could “dig America out of decades of accumulated tech debt” and “fast‑forwarded what we should have been doing for the last 20 years.”
Anthropic, Mythos, and the administration feud
Mythos is produced by Anthropic, a company whose relationship with the federal government has become contentious. Moderator David Sanger noted that Anthropic is the maker of Mythos, “with which the administration is feuding.” The source reports that President Donald Trump and Secretary Pete Hegseth banned federal use of Anthropic products in social media posts described as “blistering,” and that Anthropic is pursuing two parallel lawsuits against the government. Michael himself had posted on X to call the company’s CEO “a liar [with] a God‑complex.”
“Not single‑threaded”: diversifying models and cleared deployments
Michael said Anthropic “isn’t irreplaceable” and framed Mythos as “really just an example of the upcoming evolution of cyber‑capable models, just slightly ahead.” He predicted that “these kinds of cyber models … whether OpenAI’s or xAI’s, Google’s … will all come out in the next year or so [with] this exquisite cyber capability…. Ultimately, hopefully, they have mostly the same data, and they’re mostly going to converge.”
To reduce dependence on any single vendor, Michael said, “never again will we be single‑threaded with any one model.” He pointed to last week’s announcement that eight leading tech firms are being cleared to deploy AI on classified networks as proof of a push to broaden supply and move more models into government‑compatible environments. “These are US companies, or US champions,” Michael said. “This was a recognition that most of the industry, the vast majority of them, wants to do that with us.”
What this means for technologists, policymakers, and the Pentagon
- Technologists and security teams: Expect capabilities that can find and patch vulnerabilities far faster than current human‑paced workflows — Sutton’s “minutes to seconds” — but also a compressed window in which attackers can exploit those same flaws. Teams will need to plan for AI‑driven triage and high‑speed remediation, while watching for faster, AI‑enabled offensive tools.
- Policymakers and regulators: The Anthropic‑government feud, including two parallel lawsuits and public bans on Anthropic products by the president and a cabinet secretary, shows legal and political friction can complicate access to promising tools. Regulators will face decisions about how to certify, limit, or require controls on models that are both defensive and potentially offensive.
- The Pentagon: Leaders are signaling a shift away from single‑vendor dependence and toward multiple cleared providers on classified networks. But they also acknowledge that the department’s legacy codebase and accumulated “tech debt” remain a central vulnerability even as AI tools promise to accelerate remediation.
Taken together, the officials’ message was pragmatic optimism: models like Mythos could materially accelerate secure‑coding and patching, but they will accelerate exploitation too. The near term, as both Sutton and Michael framed it, is a race — not only between defenders and attackers but between policy choices that govern access and the technical work needed to bring dozens of years of buggy systems up to speed. Will diversifying cleared models and moving AI onto classified networks close that dangerous window? The administration’s public ban on Anthropic and the company’s lawsuits mean how quickly, and with whom, the government adopts these tools remains an open question.
