OpenAI and Anthropic briefed Congress on cyber AI models (GPT 5.4 Cyber and Mythos) that independently discovered 16 year old and 27 year old vulnerabilities missed by five million automated scans, scoring 83.1% on the CyberGym benchmark. The Pentagon remains formally excluded…
Federal cyber defense officials in Washington last week watched OpenAI's GPT-5.4-Cyber model find a 16-year-old vulnerability in FFmpeg that automated security scanning tools had hit five million times without catching. They watched Anthropic's Mythos find a 27-year-old bug in OpenBSD that had sat undetected since 1999. Three days later, two members of Congress were demanding to know why the Pentagon remains formally blocked from accessing either capability.
Representatives Chrissy Houlahan and George Whitesides sent a letter to Defense Secretary Pete Hegseth asking why the Pentagon is excluded from Mythos while the same model is being offered to roughly 40 organizations, including parts of the federal government, under a restricted access program. The letter puts the administration on record needing to justify a decision that has left the U.S. military locked out of tools civilian agencies are actively testing.
The capabilities on display were unusual enough that both companies made unusual choices. Anthropic withheld Mythos from public release entirely, calling the cyber risks too sensitive. On the CyberGym benchmark, which measures how well an AI can find real-world security flaws, Mythos scored 83.1 percent. Anthropic's previous flagship model scored 66.6 percent, according to Anthropic's Glasswing project page. If a system can surface bugs that every automated scanner in wide deployment has missed, it changes what is possible for defenders and attackers. OpenAI is releasing GPT-5.4-Cyber first to vetted vendors and researchers rather than to the general public.
Anthropic is offering Mythos under a restricted partnership structure called Project Glasswing. According to Axios, the roster now includes Amazon Web Services, Apple, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, NVIDIA, Palo Alto Networks, and the Linux Foundation. The list includes companies that build the tools federal agencies actually rely on, which suggests the security community takes the capabilities seriously regardless of the Pentagon's position.
The Pentagon blacklisting grew out of a direct dispute with Defense Department officials. Anthropic has been explicit: it will not build AI systems designed to kill people without a human in the loop. The DoD wanted something different. Reuters reported that Treasury Secretary Scott Bessent and White House Chief of Staff Susie Wiles met with Anthropic CEO Dario Amodei at the White House on April 17, a meeting that suggests the pressure around the designation extends well beyond the defense committee. Hegseth has not publicly explained why the Defense Department chose to lock itself out.
Representative Andrew Garbarino chairs the full House Homeland Security Committee and has been pushing for visibility into how AI chatbot systems behave in national security contexts. Andy Ogles chairs the committee's cybersecurity subcommittee. The briefing, described by Axios, was partly a response to that pressure.
Neither company was compelled to attend. Both went anyway. That choice is the political signal. Both companies have spent years lobbying against regulatory frameworks they viewed as premature or overbroad. Anthropic has been more vocal about AI risks but equally resistant to legal constraints. OpenAI has emphasized industry coordination and self-regulation.
One reading is that they saw an opening to shape how Washington thinks about AI in cybersecurity before legislation forced them to the table on worse terms. Another is that the briefing was damage control for a crisis created by the Pentagon's blacklisting, dressed as civic duty.
Houlahan and Whitesides want answers from Hegseth. The agencies evaluating Mythos are presumably reporting back on what it can and cannot do. The Pentagon remains on the outside of something the rest of the government is starting to take seriously.
Hegseth's response to the congressional letter will either validate the blacklisting as a principled stand on weapons autonomy or expose it as a bureaucratic decision that has left U.S. cyber defenses less equipped than they could be. That distinction will determine whether this story moves from briefing rooms to budget fights.