The Spy Who Hacked Me

The world’s most powerful spy agency has a new weapon, built in San Francisco.

This week, the Financial Times reported that the US National Security Agency is using Anthropic’s Mythos AI model for offensive cyber operations.

Anthropic has reportedly embedded around half a dozen of its own engineers inside the agency. Their job is to tailor the model and guide its use.

Mythos is no ordinary chatbot. It can find and exploit software flaws at a scale no human team could match.

One person close to the operation said it ‘would be useful’ for breaking into the networks of nations such as China or Iran. Which means it’s likely already happening.

AI is now on the frontline.

That single idea explains where cybersecurity is now heading.

A Company at War with Its Own Government

This little arrangement is striking for another reason. Anthropic and the Pentagon are currently fighting in court.

The company drew a red line last year. It refused to let its models be used for mass surveillance of citizens or for autonomous weapons.

The Pentagon hit back by branding Anthropic a ‘supply-chain risk.’ It was the first time a US business had been given the label, which is usually reserved for foreign firms tied to America’s enemies.

This week, Defense Secretary Pete Hegseth doubled down. He rejected Anthropic’s appeal and kept the designation in place.

The fight now moves to a federal appeals court. Judges there will decide how far the government can go in blacklisting its own companies.

Trump also weighed in this week. He signed a softened order that gives agencies early access to frontier models before they reach the public.

So, Washington wants to punish Anthropic and use its best tool at the same time. That contradiction shows how valuable this technology has become.

The SaaSpocalypse Aftermath

This matters for your portfolio more than it might first seem.

As Anthropic rolled out its cyber tools through early 2026, investors took fright. The reasoning was simple. If an AI can find the bugs, who needs a cybersecurity company?

The selling was heavy. CrowdStrike, Palo Alto Networks and other major sector names took a beating.

It was part of a wider rout that traders nicknamed the ‘SaaSpocalypse.’ Fears that AI would eat software wiped close to a trillion dollars off the sector in under a week.

In early March, I wrote about the building power of these systems. I even highlighted the huge opportunity in the space amid the selloff, saying:

‘But in my opinion, this has gone too far. The fear has dragged down quality cybersecurity names.

That’s created an opening worth paying attention to…

If anything, AI-driven attacks have made CrowdStrike’s automated response systems more critical, not less. And customers are spending accordingly.’

At the time, I shared this chart:

Source: TradingView

[Click to open in a new window]

The S&P 500 software and services index had dropped more than 25% over the first months of the year.

The market had decided that AI could do everything software does, only cheaper.

The Bears Got It Wrong

Then the earnings arrived.

Far from being replaced, the cybersecurity majors reported booming demand. The same AI frightening investors is also arming a new wave of attackers.

CrowdStrike crossed US$5 billion in annual recurring revenue and posted its first net profit. Palo Alto Networks held operating margins above 30%.

What does that same chart look like now?

Source: TradingView

[Click to open in a new window]

That was, in fact, the bottom. Since then, many of those stocks are up 20–80%. The reason is not complicated.

Mythos scans code and finds software weaknesses at machine speed. Criminals can run the same play. Every business now faces a faster and cheaper class of attacker.

Australia has felt the impact of these breaches in the past. Tens of millions of us already have our personal data exposed online from hacks.

My credit card was used in Seattle by a hacker just last week.

Defending against this new threat takes more security spending, not less. The firms doing the defending are also building AI into their own products.

CrowdStrike’s Falcon platform is one example, and several major cybersecurity firms are partners in Anthropic’s own security program.

The threat and the cure now come from the same place.

Where the Value Sits

None of this makes these stocks cheap, and I’m not giving you a direct list to buy today.

Valuations remain steep. CrowdStrike still trades at more than 20 times sales, and a recent pullback has done little to ease that.

The market is also turning fussier. Last week, Zscaler fell 32% in a single session after weak guidance, its worst day on record.

That move is a useful warning. The sector will throw up clear winners and clear losers from here.

For Aussie investors, the plays almost all sit offshore. The ASX offers little beyond a handful of microcaps, which lack the capital to push towards the new AI needs.

CrowdStrike [NASDAQ:CRWD] and Palo Alto Networks [NASDAQ:PANW] are the obvious large-cap names to consider. But I think Fortinet and SentinelOne belong in the same conversation.

For those who would rather not pick one stock, the HACK ETF spreads the bet across the sector.

To me, this theme will remain more durable than many think.

The NSA story is a glimpse of the future. Governments and criminals now share AI that can break almost anything.

That’s alarming. It is also the strongest tailwind the security industry has ever had.

The companies cleaning up the mess will be billing for years.