Key Takeaways

  • The European Commission has sent officials to San Francisco to negotiate access to Anthropic’s Mythos cybersecurity model.
  • US national security concerns have restricted broader Mythos distribution, prompting EU frustration and renewed focus on AI Act enforcement powers.
  • OpenAI’s offer of ChatGPT 5.5 as an interim evaluation model adds complexity to the regulatory dynamics around frontier AI risk assessment.

The European Commission is intensifying its campaign to obtain access to Anthropic’s Claude Mythos cybersecurity model, a tool viewed in Brussels as central to evaluating emerging frontier AI risks. According to reporting from Bloomberg, Commission representatives traveled to San Francisco this week to meet with Anthropic PBC and press for expanded access to the Mythos Preview model for European companies. That trip reflects growing urgency inside the EU, where regulators see the model as an important component of their upcoming AI Act enforcement strategy.

Europe has been trying to gain regulated access ever since Anthropic introduced Project Glasswing, the program allowing selected organizations to test Mythos on real operational networks. EU banks, critical infrastructure operators, and tech firms have been among those signaling interest. The Commission’s own AI Office has also sought direct regulatory access, which aligns with what the International Association of Privacy Professionals (IAPP) reported regarding EU frontier AI concerns. The Commission is currently evaluating its enforcement options under the EU AI Act before August 2026, when new investigatory powers come online.

Anthropic has indicated it is open to expanding the trial pool. The complication is that US officials have repeatedly restricted broader distribution based on national security concerns. As Bloomberg described, White House officials recently declined Anthropic’s request to distribute Mythos to several dozen additional organizations. That blockade has become a political flashpoint in Europe, particularly in France, where ministers have been pushing for access. The Eurogroup President emphasized the urgency in early May, noting that the EU does not have the luxury of delaying cross-border dialogue on AI.

Industry data shows why the stakes are high. According to IDC, global spending on AI software is expected to reach $297 billion by 2027. Security and risk analytics are among the fastest-growing slices of that market. Nearly 70% of enterprises report at least one major security event tied to AI misuse or poorly governed automation, as documented in the ENISA 2023 Threat Landscape. AI cyber models like Mythos Preview can surface decades-old vulnerabilities in fully patched systems and assemble working exploits. This capability makes the tool powerful for defenders, but potentially catastrophic in the wrong hands.

The Commission’s deliberations also overlap with broader industry standards. Many technical evaluations of frontier AI models, including Mythos and OpenAI’s ChatGPT 5.5, increasingly refer to the NIST AI Risk Management Framework as a baseline for responsible deployment. The framework emphasizes transparency, documentation, and monitored access for high-capability systems. Applying those principles to a model capable of uncovering long-forgotten, high-severity vulnerabilities is proving to be a complex regulatory challenge.

While Anthropic and the EU continue negotiating, OpenAI has offered the Commission access to its ChatGPT 5.5 frontier model for cyber vulnerability analysis. That offer, covered by the IAPP in its reporting on EU cybersecurity risk debates, has given Brussels a temporary alternative. Yet the Commission’s interest remains firmly focused on Mythos, due to the model’s specialized design for vulnerability discovery. Senior officials are concerned that relying on a substitute model complicates the emerging risk classification structure under the EU AI Act.

Security analysts tend to view the tension through a different lens. Gartner has pointed out in its cybersecurity market commentary that organizations adopting generative or autonomous analysis tools often struggle to implement proper governance, especially when the tools interact with sensitive infrastructure. That observation aligns with what IBM found in its Cost of a Data Breach 2024 report, which traces 95% of security incidents back to human error. Models capable of finding critical vulnerabilities can help reduce those mistakes, provided they undergo controlled evaluation.

Meanwhile, Anthropic faces pressure on multiple fronts. The company recently confirmed it is investigating reports that unauthorized users accessed Mythos indirectly through third parties. The incident ignited concerns that Project Glasswing’s security controls were compromised. For a model already restricted by the US government due to security risks, that kind of unauthorized access adds to regulatory scrutiny.

The EU’s growing frustration stems partly from timing constraints. The AI Act’s new enforcement mechanisms take effect in August 2026, and if Anthropic declines to provide access by then, the Commission could theoretically compel cooperation. Cross-border cooperation on frontier AI remains delicate, given the multilateral pressures regarding international governance frameworks. The global landscape is shifting quickly, and shared frameworks remain limited.

Frontier AI models are beginning to reshape security workflows, market forecasts, investment plans, and regulatory strategies. Demand for advanced cyber models is rising, and vendors are attempting to balance commercial expansion with geopolitical constraints. Mythos forces these companies to directly navigate the conflict between defensive vulnerability discovery and the risk of automated exploitation. The EU wants to evaluate the model's capabilities, the US wants to restrict its distribution, and Anthropic is left managing these conflicting expectations.

European enterprises face rising exposure to increasingly automated cyber threats, and tools like Mythos or ChatGPT 5.5 could offer defensive advantages. Analysts at Bloomberg and others observing the negotiations have noted that uncertainty around access may slow some defensive modernization plans. The Commission’s direct involvement signals that Brussels intends to secure a formal process for evaluating high-risk AI tools.

Regulatory access to frontier AI models directly impacts national security, industrial competitiveness, and technical risk management. Whether the Commission and Anthropic find an agreement in San Francisco, or whether the AI Act becomes the decisive instrument, the outcome will set a precedent for how governments oversee advanced vulnerability discovery tools.