BNP Paribas collaborates with Mistral to provide a European solution to Anthropic's Mythos.

      BNP Paribas is collaborating with Mistral AI to develop a category of AI cybersecurity tools that its US counterparts are already utilizing, but which European regulators have difficulty accessing, according to a Bloomberg report published on Tuesday. The Paris-based bank, which holds the title of the largest in the eurozone by assets, is among several European institutions assisting Mistral in creating a cybersecurity model designed to rival Anthropic’s Mythos.

      Mythos is an AI system with restricted access that Anthropic introduced earlier this year; it is capable of identifying and exploiting security vulnerabilities at machine speed. In controlled tests, the model successfully produced working exploits on its initial attempt over 83% of the time, often outperforming human red team testers.

      Access to Mythos has been intentionally limited to around 40 to 50 organizations, primarily large US tech companies, US national-security partners, and a few US banks, including JPMorgan Chase. No European bank is included on this list. The European Commission has been engaged in stalled negotiations with Anthropic regarding access since April, with Spanish officials publicly characterizing the discussions as at an impasse.

      The European Central Bank has recently cautioned eurozone regulators that tools of the Mythos caliber alter the threat landscape for banks, irrespective of who can access them. Frank Elderson of the ECB informed banks earlier this month that if attackers acquire a similar model, defenders lacking one would be at a structural disadvantage.

      The Bundesbank has officially supported Brussels in urging Anthropic for access. Anthropic has, thus far, opposed broader distribution, claiming it would turn the model into a potential weapon. Mistral is attempting to bridge this gap. The French company, already the most well-funded foundation-model enterprise in Europe, has been proposing a sovereign European alternative since at least mid-May. BNP Paribas’s involvement marks a significant indication that the European banking sector is ready to invest in the project rather than wait for the Brussels-Anthropic negotiations to yield results.

      The two entities have already established a three-year commercial agreement encompassing Mistral’s wider model lineup, which was signed in February.

      Current public information does not clearly show what the Mistral cyber model would accomplish, and this has not been independently verified. Mythos is a specific type of system trained to integrate vulnerability discovery with exploit generation in a single workflow, meaning replicating this capability without access to the red team data that Anthropic has collected will be challenging.

      The pitch to BNP Paribas and other potential European bank clients suggests that a sovereign model, even if less capable, is better than having no model for defense purposes. It also acts as a safeguard against the possibility of a permanent collapse of the Brussels-Anthropic negotiations.

      This trend mirrors familiar patterns from the past year in European tech policy: a US firm develops a cutting-edge capability, restricts access for safety or national security reasons, and European institutions seek to create a domestic equivalent. This rationale has also fueled recent European initiatives on cloud sovereignty, payment systems, and most conspicuously, semiconductor manufacturing. Banking cyber-AI represents the latest addition to this list, with the BNP Paribas-Mistral collaboration being its most prominent concrete initiative.

      Neither BNP Paribas nor Mistral provided comments regarding the specific Bloomberg report. To date, Mythos has yet to be demonstrated in a European bank environment.