News · 2026-06-24
An AI Reportedly Broke Into Nearly All of the NSA's Classified Systems in Hours
Two weeks ago the US government did something it had never done before: it ordered Anthropic to switch off its two most powerful new models, Fable 5 and Mythos 5, for everyone on the planet. At the time the official reason was vague -- a security capability the government considered too dangerous to leave in the open. This week a much sharper version of why surfaced, and it is the kind of claim that changes how the whole episode reads.
According to reporting in Security Affairs, which quotes The Economist, Senator Mark Warner -- the vice-chair of the Senate Intelligence Committee -- said that General Joshua Rudd, who runs both the National Security Agency and US Cyber Command, told him the Mythos model 'broke into almost all of our classified systems, not in weeks, but in hours.' This happened inside a red-team exercise, the controlled kind of test where you deliberately point your most capable attacker at your own defenses to see what breaks. That test is now described as the reason behind the government's June 12 directive that forced Anthropic to restrict the models, after which the company shut them off worldwide. We covered the shutdown itself when it happened, in the story of how Washington made a frontier model disappear.
It helps to be precise about what is being claimed, because the headline and the reality are not quite the same thing. A red-team exercise is a sanctioned drill. The model was pointed at those systems on purpose, by people who wanted to find holes. That is very different from an AI deciding on its own to attack a government and succeeding -- nothing of the sort is being alleged. What is being alleged is still striking: that when you aim this tool at hardened, classified networks and let it work, it finds its way in fast, across almost everything, with little human steering. Security Affairs itself flags the obvious caveat in plain terms, noting these are 'unverified claims reported through Senate testimony, not independently confirmed facts.' Nobody outside the room has seen the actual test.
Here is the analogy that makes the policy fight make sense. Imagine hiring the world's most gifted lockpicker to audit the locks in a government building. The skill that lets them open every door in an afternoon is exactly the skill you would want if your job were to find and fix weak locks. You cannot split that person into a 'good half' that only fixes locks and a 'bad half' that picks them, because it is one skill. Anthropic's long-running position is that its model's talent for reading software and spotting flaws is precisely this kind of dual-use ability -- the same thing a defender uses to harden systems and an attacker uses to break them. The independent research group Epoch made the careful version of this argument earlier, drawing a line between two skills people keep blurring, in its piece on whether these models' cyber abilities are overhyped: finding a weakness is not the same as building a working attack from it, and a model can be unnervingly good at the first while still clumsy at the second.
Why does this matter beyond one company and one scary anecdote? Because it quietly upgrades the stakes of the original shutdown. When the models were pulled, the most common read was that this was a heavy-handed but ultimately patchable safety stop -- a regulator being cautious. If the red-team claim is even roughly accurate, the government was reacting to something closer to a genuine offensive capability, the digital equivalent of a tool that can pick almost any lock. That makes the no-warning, switch-it-off-globally response look less like overreaction and more like a deliberate signal to every other lab: brief us before you ship something this capable, or we will reach in and stop you. It also reframes a rival lab's recent decision to pitch itself as the safe, responsible cyber lab as a calculated move in exactly this moment.
The honest center of the story is the same as it was two weeks ago, only sharper. The worry about the capability is reasonable. The way it is being communicated -- through a senator paraphrasing a general in a setting where the underlying evidence is classified -- is the part to hold loosely. 'Almost all, in hours' is a memorable line precisely because it is dramatic, and dramatic lines are the ones most likely to get compressed and amplified on the way out of a closed hearing. Until someone publishes a test anyone can examine, the strongest claims on every side rest on inference, not on a document outsiders have read. For how outside experts are being let in to check work like this, see our story on safety testers getting inside the frontier labs. What is no longer in doubt is that the people who run America's most sensitive networks took a look at one of these models and decided they did not want it out in the world without their say-so.