Why the EU Is Concerned About the Mythos Model

Anthropic introduced Claude Mythos Preview in April 2026 but chose not to release it publicly. The company said the model’s ability to identify and exploit vulnerabilities is so powerful that it had already uncovered hundreds of critical flaws in widely tested software.

European policymakers quickly flagged the implications. Members of the European Parliament warned that emerging cyber‑capable AI models—including Mythos and similar systems—could dramatically change the cybersecurity landscape by making vulnerability discovery far faster and more automated.

For regulators, the worry is twofold:

• Defensive gap: If attackers gain similar tools before defenders do, critical systems could become more vulnerable.
• Oversight gap: Governments may struggle to evaluate or regulate models they cannot directly access or test.

What Project Glasswing Is—and Why It Limits EU Participation

Instead of broad release, Anthropic placed Mythos inside a restricted research initiative called Project Glasswing. The program grants access only to a small group of vetted partners tasked with using the model for defensive security work, such as scanning software and patching vulnerabilities before they become public.

Participants include major technology and infrastructure companies such as AWS, Apple, Google, Microsoft, Nvidia, Cisco, and JPMorgan Chase.

This approach intentionally limits access to organizations responsible for maintaining critical digital infrastructure. However, it has also created a major imbalance from the EU’s perspective:

• Most early partners are large U.S. technology companies or U.S.‑based institutions.
• European governments and regulators have largely been excluded from direct access so far.

As a result, EU policymakers argue that European companies and institutions cannot independently test their systems against vulnerabilities that the model might uncover.

Why Finance Ministers and Banks Are Involved

The issue has escalated beyond technology policy because the financial system is considered especially exposed to AI‑driven vulnerability discovery.

European officials have discussed ways to ensure banks can test their systems using tools like Mythos. EU economy commissioner Valdis Dombrovskis confirmed that the European Commission has been in contact with Anthropic and wants European companies and banks to have opportunities for cybersecurity testing using the model’s capabilities.

Regulators have warned that advanced AI vulnerability‑scanning tools could significantly increase risks to banking infrastructure if defensive teams cannot use similar technology.

Separately, Anthropic has reportedly prepared briefings for global financial regulators through the Financial Stability Board, highlighting vulnerabilities the model has already identified in financial systems.

The Contrast With OpenAI’s GPT‑5.5‑Cyber Access

The dispute has intensified because another AI company took a different approach.

In May 2026, OpenAI announced it would grant the European Union preview access to its cybersecurity model GPT‑5.5‑Cyber. Access is expected to include European governments, businesses, and authorities such as the EU AI Office.

That decision created a clear contrast:

• OpenAI: offering the EU structured preview access to a cyber‑defense AI model.
• Anthropic: keeping Mythos restricted to Project Glasswing partners, with EU regulators still negotiating potential access.

For European policymakers, the difference has turned the issue into a question of technological parity and trust.

The Bigger Policy Debate: AI, Security, and Trust

The Mythos controversy highlights a broader challenge facing governments and AI developers.

Models capable of autonomously discovering software vulnerabilities could help defenders secure infrastructure faster—but they could also enable sophisticated cyberattacks if misused. Because of this dual‑use nature, companies like Anthropic have chosen tight access controls instead of open release.

At the same time, governments argue that excluding regulators and allied countries from early access creates new risks:

• They cannot independently assess the technology.
• Critical industries may be unable to prepare for vulnerabilities the models reveal.

As a result, debates over Mythos are increasingly framed not just as a technical matter but as a geopolitical issue involving AI governance, cybersecurity preparedness, and global technology cooperation.

What Happens Next

Negotiations between Anthropic and EU institutions are ongoing, with European officials seeking pathways for regulated access to the model’s capabilities.

Meanwhile, the broader question remains unresolved: who should control access to AI systems capable of discovering—and potentially exploiting—critical software vulnerabilities.

How companies and governments answer that question may shape the global cybersecurity landscape as AI capabilities continue to accelerate.

Why the EU Is Concerned About the Mythos Model

Anthropic introduced Claude Mythos Preview in April 2026 but chose not to release it publicly. The company said the model’s ability to identify and exploit vulnerabilities is so powerful that it had already uncovered hundreds of critical flaws in widely tested software.

European policymakers quickly flagged the implications. Members of the European Parliament warned that emerging cyber‑capable AI models—including Mythos and similar systems—could dramatically change the cybersecurity landscape by making vulnerability discovery far faster and more automated.

For regulators, the worry is twofold:

• Defensive gap: If attackers gain similar tools before defenders do, critical systems could become more vulnerable.
• Oversight gap: Governments may struggle to evaluate or regulate models they cannot directly access or test.

What Project Glasswing Is—and Why It Limits EU Participation

Instead of broad release, Anthropic placed Mythos inside a restricted research initiative called Project Glasswing. The program grants access only to a small group of vetted partners tasked with using the model for defensive security work, such as scanning software and patching vulnerabilities before they become public.

Participants include major technology and infrastructure companies such as AWS, Apple, Google, Microsoft, Nvidia, Cisco, and JPMorgan Chase.

This approach intentionally limits access to organizations responsible for maintaining critical digital infrastructure. However, it has also created a major imbalance from the EU’s perspective:

• Most early partners are large U.S. technology companies or U.S.‑based institutions.
• European governments and regulators have largely been excluded from direct access so far.

As a result, EU policymakers argue that European companies and institutions cannot independently test their systems against vulnerabilities that the model might uncover.

Why Finance Ministers and Banks Are Involved

The issue has escalated beyond technology policy because the financial system is considered especially exposed to AI‑driven vulnerability discovery.

European officials have discussed ways to ensure banks can test their systems using tools like Mythos. EU economy commissioner Valdis Dombrovskis confirmed that the European Commission has been in contact with Anthropic and wants European companies and banks to have opportunities for cybersecurity testing using the model’s capabilities.

Regulators have warned that advanced AI vulnerability‑scanning tools could significantly increase risks to banking infrastructure if defensive teams cannot use similar technology.

Separately, Anthropic has reportedly prepared briefings for global financial regulators through the Financial Stability Board, highlighting vulnerabilities the model has already identified in financial systems.

The Contrast With OpenAI’s GPT‑5.5‑Cyber Access

The dispute has intensified because another AI company took a different approach.

In May 2026, OpenAI announced it would grant the European Union preview access to its cybersecurity model GPT‑5.5‑Cyber. Access is expected to include European governments, businesses, and authorities such as the EU AI Office.

That decision created a clear contrast:

• OpenAI: offering the EU structured preview access to a cyber‑defense AI model.
• Anthropic: keeping Mythos restricted to Project Glasswing partners, with EU regulators still negotiating potential access.

For European policymakers, the difference has turned the issue into a question of technological parity and trust.

The Bigger Policy Debate: AI, Security, and Trust

The Mythos controversy highlights a broader challenge facing governments and AI developers.

Models capable of autonomously discovering software vulnerabilities could help defenders secure infrastructure faster—but they could also enable sophisticated cyberattacks if misused. Because of this dual‑use nature, companies like Anthropic have chosen tight access controls instead of open release.

At the same time, governments argue that excluding regulators and allied countries from early access creates new risks:

• They cannot independently assess the technology.
• Critical industries may be unable to prepare for vulnerabilities the models reveal.

As a result, debates over Mythos are increasingly framed not just as a technical matter but as a geopolitical issue involving AI governance, cybersecurity preparedness, and global technology cooperation.

What Happens Next

Negotiations between Anthropic and EU institutions are ongoing, with European officials seeking pathways for regulated access to the model’s capabilities.

Meanwhile, the broader question remains unresolved: who should control access to AI systems capable of discovering—and potentially exploiting—critical software vulnerabilities.

How companies and governments answer that question may shape the global cybersecurity landscape as AI capabilities continue to accelerate.