Why the EU is currently seeking access to Anthropic's Mythos.

      An AI model developed by Anthropic that is capable of discovering zero-day vulnerabilities in all major operating systems has sparked geopolitical and security concerns. The Eurogroup convened in Brussels on Monday but came away without a resolution.

      Traditionally, discussions about the world’s most advanced AI models do not take place in Brussels on a Monday morning in early May. The Eurogroup gathers in an elegant yet practical setting where finance ministers exchange position papers.

      Typically, their agenda focuses on operational resilience, details of banking union, and the precise language of Council conclusions, rarely generating headlines. However, on May 4, the conversation shifted to a different topic. Bloomberg reported that finance ministers from the euro area gathered to discuss Anthropic's Mythos AI model and the fact that no European government currently has access to it. This model, disclosed by Anthropic on April 7, can identify and potentially exploit zero-day vulnerabilities across all major operating systems and web browsers.

      For weeks, the White House has been blocking Anthropic’s request to extend access to around 70 additional organizations. Meanwhile, European banking regulators have been assessing the implications of this access gap for the financial system.

      In its announcement of Project Glasswing on April 7, Anthropic described the Mythos model as a cutting-edge system that can identify software vulnerabilities more effectively and faster than even the most skilled human researchers. It uncovered thousands of high-severity vulnerabilities in just days, including a 27-year-old bug in OpenBSD, a 16-year-old remote code execution flaw in FreeBSD, and 271 distinct Firefox vulnerabilities that Mozilla patched after a single assessment.

      According to cryptography expert Bruce Schneier and other analysts discussing the model's strategic implications, the implications for cyber defenders are clear. An offensive AI model like this provides attackers with a structural edge that defenders cannot counter unless they have similar access. Consequently, defenders without comparable access are at a significant disadvantage, a calculus that European banking supervisors are evaluating.

      The Bundesbank was the first to act, publicly urging the EU at the end of April to demand access to Mythos, arguing that, without it, European banks could not realistically gauge their infrastructure against threats that an attacker armed with the model could exploit. The European Central Bank has also initiated discussions with chief risk officers at eurozone banks, gathering information on preparations for AI-driven cyberattacks. Christine Lagarde, the ECB President, acknowledged Anthropic as a responsible operator but cautioned that the model in the wrong hands could lead to dire consequences.

      Switzerland's regulator took a more severe stance, with FINMA warning in April that providing broad access to Mythos could pose systemic risks to Swiss banks—not due to any malicious intent behind the model, but because deploying such offensive-security capabilities without the necessary defensive infrastructure could overwhelm internal response mechanisms. Similarly, Australia's ASIC joined the monitoring efforts, and Kristalina Georgieva, the IMF Managing Director, noted during the Fund’s spring meetings that the international monetary system lacks adequate protections against sustained AI-enhanced cyber threats.

      While these statements are not new in policy terms, the speed at which they have coalesced around a single product is unprecedented.

      Why is the White House opposing broader access? The administration's stance is that extending access to Mythos raises two key concerns. The first is about misuse: a model that can create exploits cannot be distributed safely. The second concerns operational capabilities: the infrastructure required for a wider rollout—cleared facilities, access controls, and monitoring—does not yet exist for the larger user bases Anthropic intends to include.

      There is also a more subtle dynamic at play: the National Security Agency is already utilizing Mythos through pre-existing arrangements, while the Pentagon has categorized Anthropic as a supply-chain risk related to procurement issues. Additionally, the US Treasury has requested access to Mythos to identify vulnerabilities in its systems. Thus, the administration maintains a restrictive policy on external distribution while being permissive regarding its own use, a position that is consistent internally but strategically challenging when applied to allies who would typically expect to be included in such arrangements.

      This asymmetry, rather than the model itself, has triggered the European response.

      What Anthropic has communicated publicly has been cautiously worded. The company has recognized the need for new safeguards for Mythos's capabilities, which Project Glasswing aims to provide. It has partnered with AWS, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorgan Chase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks for this initiative. However, the representation from financial services is minimal, with JPMorgan Chase being the only explicitly mentioned bank. Reports indicate that Goldman Sachs and Citigroup are evaluating the model internally, yet no European bank appears on the list of initial partners.

      Privately, Anthropic has suggested to officials that European access will be available "soon," a typical hedge in commercial diplomacy, but no formal agreement has been established. The Eurogroup’s recent meeting did not yield a resolution but did signal that European supervisors