Most AI systems aren't ready. Check yours in 15 min →
AP

Anthropic Partners with NSA on Cyber AI While Urging Global Pause

AuthorAndrew
Published on:
Published in:AI

Watching a company ask the world to “pause” AI while it quietly helps build AI for cyber war is not caution. It’s power politics with a safety mask on.

And I don’t even mean that as a cute gotcha. I mean it as the actual strategy. “Slow everyone down” on the outside, “move faster with the state” on the inside. If that’s what’s happening here, we should at least be honest about what game we’re playing.

From what’s been shared publicly, Anthropic is collaborating with the NSA. Not in a vague “we care about national security” way, but in a practical way: engineers helping implement an AI model—reported as “Mythos”—for offensive cyber operations against adversaries like China and Iran. That’s not defensive patching. That’s building tools to break into other systems, disrupt them, and win contests that happen in silence.

At the same time, Anthropic has been calling for a global pause in AI development, comparing the moment to Cold War-style control agreements. The argument is familiar: AI could improve itself without human oversight, and we could lose control. That fear might be real. But pairing that public stance with an intelligence partnership creates a pretty sharp contradiction.

Here’s my read: this isn’t hypocrisy by accident. It’s the modern version of “rules for thee, not for me,” except the “me” is a tight alliance between a tech company and a national security agency.

Some people will say, “So what? Every serious technology ends up in defense.” Sure. The internet did. GPS did. Even boring stuff like supply chain software ends up in war planning. But there’s still a difference between tech being adapted later and a company actively embedding with an intelligence agency to make offensive operations work better. That’s not the technology “being used.” That’s the company choosing sides and shaping outcomes.

And once you’re in that room, incentives change. You stop optimizing for “won’t be misused” and start optimizing for “works under pressure.” You stop asking “should we” and start asking “how fast can we ship.” Even if the people involved are decent, the environment pulls you in a direction.

There’s another detail that matters here: public reporting says the Pentagon tried to restrict Anthropic’s technology because of worries about surveillance and autonomous weapons, and that Anthropic challenged the ban in court and won. I’m not going to pretend I know the full legal record from a social post. But if the gist is right, it’s telling. A company can present itself as safety-first, then fight to keep its tech available when the concern is exactly the kind of use it now seems to be supporting—surveillance and weapon-like autonomy.

If you’re a regular person, this can sound distant. “Cyber warfare” feels like spy-movie stuff until it hits the boring parts of life. Imagine you’re running a small hospital and systems go down because of a state-backed attack. Imagine you’re an accountant and your client’s business gets locked up. Imagine you work for a city and the water system’s controls get messed with. Offensive cyber is not clean. It does not stay neatly on “the battlefield.” It spills.

Now flip it: imagine you’re sitting inside government and you believe rivals are already using AI to find holes faster, write better malware, and run more convincing deception. You’d want help yesterday. You’d argue that refusing to participate is basically disarming in public while everyone else arms in private. That argument has weight. I get it.

But here’s the uncomfortable part: once AI becomes a normal tool for offensive cyber operations, “pause” becomes a fantasy. Not because the world is evil, but because the rewards for moving are immediate and the penalties for restraint are abstract. You don’t get applause for not exploiting a weakness. You get punished if you miss one and lose.

So when a company calls for a global pause, I’m going to ask: pause for whom? If the practical outcome is “slow open research, slow smaller labs, slow competitors,” while the biggest players keep progressing behind classified walls, that’s not safety. That’s consolidation.

And that’s the risk that should make people mad: we may end up with the most advanced AI systems living inside government-security partnerships, protected by secrecy, shielded from public scrutiny, and justified by permanent emergency. If something goes wrong—an escalation spiral, a major civilian spillover, a tool that leaks—there won’t be a clean accountability trail. There will be “national security” and silence.

I’m also not fully sure what “sending engineers” really means in practice. Are they advising? Are they embedding long-term? Are they building custom features? Are there limits, audits, or hard “no” lines? The public version is always the sanitized version. And even if Anthropic has internal rules, rules are only as strong as the moment when someone important says, “We need this now.”

The thing I want to see is consistency. If a company truly believes AI is so dangerous we need a global pause, then partnering on offensive cyber should be treated as the highest-risk use case, not a special exception because the badge says “us.” If the company believes national security needs this, fine—own that openly and stop selling the pause as a universal moral stance.

So which is it: is AI development so risky that we should slow down across the board, or is it so strategically valuable that we should race ahead with intelligence agencies and just hope the rest of the world plays nice?

Frequently asked questions

What is AI agent governance?

AI agent governance is the set of policies, controls, and monitoring systems that ensure autonomous AI agents behave safely, comply with regulations, and remain auditable. It covers decision logging, policy enforcement, access controls, and incident response for AI systems that act on behalf of a business.

Does the EU AI Act apply to my company?

The EU AI Act applies to any organisation that develops, deploys, or uses AI systems in the EU, regardless of where the company is headquartered. High-risk AI systems face strict obligations starting 2 August 2026, including risk management, data governance, transparency, human oversight, and conformity assessments.

How do I test an AI agent for security vulnerabilities?

AI agent security testing evaluates agents for prompt injection, data exfiltration, policy bypass, jailbreaks, and compliance violations. Talan.tech's Talantir platform runs 500+ automated test scenarios across 11 categories and produces a certified security score with remediation guidance.

Where should I start with AI governance?

Start with a free AI Readiness Assessment to benchmark your current maturity across 10 dimensions (strategy, data, security, compliance, operations, and more). The assessment takes about 15 minutes and produces a prioritised roadmap you can act on immediately.

Ready to secure and govern your AI agents?

Start with a free AI Readiness Assessment to benchmark your maturity across 10 dimensions, or dive into the product that solves your specific problem.