The only surprise is that it's publicly being stated. I'm sure every major intelligence organization in the world has the all the components of Mythos and are running it locally. That's what they do. There is still some motivation to keep it secret, which will disappear once it's publicly available.
not Mythos, no, but they're probably running some kind of vuln-finding frontier models. maybe GLM or Kimi fine-tuned on a dataset of past CVEs or something.