Hiding in Plain Sight: The Geopolitics of Software Supply Chains

(Hans Nelson – Just Security) When Anthropic announced in April 2026 a limited preview of its Claude Mythos model capable of finding and exploiting vulnerabilities at scale, government and industry immediately focused on what it could mean for cybersecurity. Mythos Preview can reportedly find and author vulnerability exploits in hours that would have previously taken weeks. The White House even viewed the capability as significant enough to re-examine aspects of its current approach to artificial intelligence oversight. But the growing focus on AI-driven vulnerability detection risks obscuring another category of threat hidden deeper within modern software ecosystems and their supply chains. Risks facing national security systems arise not only from software code vulnerabilities, but from governance structures and strategic dependencies embedded within the larger software ecosystems. This gap creates a strategic blind spot: modern defense technologies may rely on software ecosystems whose control, influence, or development pathways lie outside the visibility of traditional supply chain risk frameworks. As the next generation of defense and weapons programs come online infused with AI capabilities, defense officials should scrutinize software supply chains supporting mission-critical defense systems with the same mindset as they do physical supply chains. Software ecosystems built upon open-source dependencies should be evaluated for geopolitical risk and subjected to risk-tiered governance reviews within the defense acquisition process. This more expansive strategic software assurance review would evaluate strategic risk stemming from things like maintainer authority, dependency governance, repository control, and indicators of foreign ownership, control, or influence. Critical defense technology software supply chains should be treated as strategic infrastructure. Fortunately, adopting a more strategic view to shielding software supply chains from risk does not require new legislation or regulation. There are already regulatory regimes in place; the necessary step towards realizing the full spirit of those regimes is improving due diligence in reviewing critical defense software supply chains. These reviews should be scoped and only performed on the most critical systems, taking advantage of existing expert personnel in the acquisition program offices, supported by the contractors’ security, compliance, and product teams. – Hiding in Plain Sight: The Geopolitics of Software Supply Chains