Anthropic may soon give the European Union’s cybersecurity agency access to Mythos, its powerful vulnerability-finding AI model.
At one level, this is a straightforward cybersecurity story. Mythos is designed to find flaws in software so defenders can patch them before attackers exploit them. For officials responsible for protecting critical infrastructure, government systems, or large networks, access to a tool like that sounds useful.
At another level, though, it is a story about who gets access to important AI systems.
The European Commission said Monday that it has held “several productive meetings” with Anthropic about giving EU bodies access to Mythos. The most likely recipient is ENISA, the EU’s cybersecurity agency.
The interesting thing is that Europe is not trying to build or buy Mythos. It is trying to get access to Anthropic’s version of Mythos.
That distinction matters because Mythos is not generally available. Anthropic has made the model available through Project Glasswing, a restricted cybersecurity program that includes a relatively small group of partners. Those partners include major American technology companies and Britain’s AI Security Institute. Until now, no EU agency was on the list.
The frustration is easy to understand. Suppose there is a model that is unusually good at finding vulnerabilities in computer systems. Suppose that model is built and controlled by an American company. European governments, banks, infrastructure operators, and software firms all face cybersecurity risks that such a model could help address. If access to the model is restricted, Europe naturally wants to know where it sits in the queue.
This is not the first time Mythos has become a geopolitical object. The model has already been the subject of debates inside the United States about who should be allowed to use it and under what conditions. US agencies have sought access. The UK has evaluated it. Anthropic has expanded testing carefully while avoiding a broad public release, and the White House reportedly opposed a wider Mythos expansion even as government agencies wanted the model for themselves.
Now Europe is joining that conversation.
In some ways, this feels like a natural extension of a broader trend. Europe has spent years building rules for AI while many of the most capable frontier models remain concentrated in a handful of American companies. Usually that creates regulatory questions. In this case, it creates an operational one.
If the best available cybersecurity model is owned by somebody else, what does sovereignty actually mean?
The answer, at least for now, appears to be negotiated access.
The details are still being worked out. AFP reported that Anthropic and EU officials are discussing questions such as how the model would be used and what visibility Anthropic might have into European systems.
That sounds technical, but it gets at the central issue. If ENISA wants to use Mythos to help secure European infrastructure, somebody has to decide what information goes into the model, where that information is processed, and who gets to see the results.
In a traditional government procurement process, Europe might buy a cybersecurity product and run it itself. That is not quite what is happening here. Instead, Europe appears to be negotiating access to a capability that remains controlled by the company that built it.
Maybe that arrangement works perfectly well. Plenty of governments already rely on private technology vendors for critical systems. But it does mean that some questions that used to be settled through ownership are now being settled through partnership agreements, access policies, and terms of service.
That is a fairly new position for governments to be in. It may become a much more common one.
–
By the Control Plane Editorial Team