Professional services / Technology consulting
Booz Allen Hamilton: Finding software exploit chains and preparing fixes with AI in security assessment work
- Company
- Booz Allen Hamilton
- Country
- United States
- Adoption stage
- Limited operation
- Source published
- Date basis
- The date the source was published. It can differ from the date adoption started.
- How the source was checked
- Read the full source text
The work problem
According to an article Anthropic published on October 6, 2026, Booz Allen Hamilton's security assessments run for a fixed period, which limits how much source code, configuration and compiled software engineers can read before they end. Real attacks often work by chaining small weaknesses across code, configuration, identity and deployment settings, and tracing those connections by hand across a large software portfolio was slow even for a skilled operator.
Technology and data
Booz Allen used Claude Mythos Preview through Project Glasswing to review far more software than a short engagement window would normally allow and to identify weaknesses that could be strung together into attack paths. The model connects application behavior, configuration, identity, permissions and deployment context into security hypotheses, and drafts fixes and assembles evidence for the engineers who own the affected systems. Analysts handle validating findings, deduplicating them and deciding where to route them.
Results
According to the President of National Cybersecurity at Booz Allen, one analyst reviewed eight production systems across 138 repositories in twelve days, and a review at that scale without Mythos would have taken several months with a larger team. In one case, by following one setting through two different programs written in two different languages, the model found a flaw in which a security key, used by code that runs before the operating system loads to decide whether a device should lock itself or erase its data, had been left unprotected.
Limits and open questions
The clients assessed, the total number of findings and the share of incorrect findings are not in the source.
Sources
Compiled from public sources. These are not results from ATF Works customers.