Detailed Analysis
Anthropic's engagement with European Union regulators over its advanced frontier model, Claude Mythos Preview, has exposed a significant tension between the pace of AI development and the capacity of public institutions to oversee it. The model, which has not been released to the general public, demonstrates capabilities in software vulnerability detection and exploitation that surpass most human experts — including the ability to reproduce high-profile historical breaches such as the 2017 Equifax attack. Mythos has topped specialized cybersecurity benchmarks including CTI-REALM, Cybench, and CyberGym, and has been deployed in defensive contexts such as DARPA's AI Cyber Challenge. Rather than pursuing broad access, Anthropic has channeled the model's capabilities through Project Glasswing, a structured collaboration with select US technology and financial firms including Amazon, Apple, Microsoft, Google, Cisco, CrowdStrike, JPMorganChase, and NVIDIA, with a focus on vulnerability disclosure, open-source security hardening, and patching automation.
The EU's limited access to Mythos has become a central point of contention. European regulatory bodies have been largely excluded from early security testing, with priority access granted exclusively to Project Glasswing partners — predominantly US-based private entities. The UK's AI Security Institute stands as a notable exception, having obtained testing access and acted on its findings. Within the EU itself, only Germany has initiated direct talks with Anthropic, and even those discussions have not yet yielded model access. This disparity has drawn criticism from security experts who argue that independent public authorities, rather than private consortia, should bear primary responsibility for evaluating the safety and risks of technologies with such significant dual-use potential.
The governance questions raised by Mythos extend well beyond Europe. Anthropic's own transparency reports acknowledge that Claude models, including variants like Opus 4.5 and Sonnet 4.5, employ hybrid reasoning architectures capable of autonomous coding and cyber operations — raising inherent dual-use concerns. The company has documented disrupting real-world AI-assisted threats, including so-called "vibe hacking" schemes used for extortion and state-sponsored espionage operations, such as the GTG-1002 campaign linked to Chinese APT actors targeting telecom infrastructure. These disclosures underscore that the offensive and defensive applications of advanced AI in cybersecurity are not theoretical; they are already operational, and the line between them is increasingly thin.
The competitive dynamics within the AI industry further complicate the regulatory picture. OpenAI's decision to widen access to its GPT-5.4-Cyber model in the wake of Anthropic's Mythos reveal suggests that frontier AI labs are now actively competing in the cybersecurity domain, potentially accelerating capability disclosures in ways that outpace institutional oversight. Project Glasswing represents one model for responsible deployment — controlled access, structured partnerships, and coordinated disclosure — but critics contend that ceding oversight authority to private entities, even well-intentioned ones, creates accountability gaps that public regulators are uniquely positioned to fill.
The broader trajectory of this situation reflects a defining challenge for AI governance: frontier capabilities are arriving faster than the international frameworks designed to manage them. The EU, which has invested significantly in establishing the AI Act as a global regulatory benchmark, finds itself in the uncomfortable position of lacking access to one of the most consequential AI systems currently in existence. Whether Anthropic's engagement with European authorities ultimately results in meaningful oversight mechanisms — or remains a diplomatic dialogue without substantive access — will serve as an important early test of whether private AI developers and public regulators can establish workable accountability structures for the most powerful AI tools yet built.
Read original article →