IC Technology & Surveillance — 2026-07-29

FBI Deputy Assistant Director Identifies Anthropic Mythos AI Vulnerability Discovery as Future Law Enforcement Challenge

BLUFProliferation of exploit-finding capability to open-source models on consumer hardware outpaces the FBI's capacity to build attribution tradecraft or complete oversight of its own AI tools.

Todd Hemmen, deputy assistant director of the FBI's Cyber Capabilities Branch, said Tuesday at a Digital Government Institute conference that Anthropic's Mythos model found vulnerabilities in open-source code underlying operating systems, security tools, web infrastructure, and encryption, calling it a "future challenge for law enforcement" 12. Hemmen said the FBI has not seen such exploitation operationalized at scale but expects that to change, and noted that Anthropic's own research found "less capable" models, including open-source systems, can identify and exploit vulnerabilities in similar ways 123. Separate research cited alongside Hemmen's remarks found Mythos identified roughly 23,000 potential vulnerabilities across nearly 1,000 open-source repositories with 89% severity-assessment accuracy against expert review, including a 27-year-old remote-crash flaw in OpenBSD's TCP stack and a 16-year-old bug in FFmpeg, each found for under $50 in compute cost. A 1.2-billion-parameter open-source model running on a consumer laptop discovered real vulnerabilities in production code in under four minutes, and a prototype AI worm built on free, open-source models exploited 73.8% of a simulated enterprise network 23. Hemmen also said the FBI is using AI internally for facial recognition and runs roughly 50 AI use cases bureau-wide, though it has not completed OMB-mandated risk management requirements for any of its high-impact applications 1.

Analysis
Hemmen's remarks mark the first public FBI acknowledgment that Mythos's vulnerability-discovery output signals a coming caseload rise rather than documented exploitation, but the admission that lesser, open-source models already replicate that behavior on consumer hardware undercuts the case for export controls on Mythos 5, since attribution only grows harder once the capability is unlicensed. A widening suspect universe pressures the Bureau to build detection and attribution tradecraft ahead of operationalized exploitation, a mandate that collides with its own unfinished OMB risk-management reviews across roughly 50 internal AI use cases, leaving facial-recognition and triage tools running without completed oversight. The framing may instead function as calibrated messaging preserving leverage over Anthropic rather than a neutral threat warning, and reporting rests on a single uncorroborated conference account.

3 sources

FBI sees Anthropics Mythos as a law enforcement challenge - FedScoop
FBI Names Mythos AI a Law Enforcement Challenge as Exploit Capability Reaches Open-Source Models - Tech Times
FBI Flags Open Source AI As Emerging Cyber Threat - Open Source For You