Anthropic Launches Mythos in Europe, but at What Cost for Data?

Anthropic Opens Mythos to ENISA After Weeks of Negotiations

Since April, the European Union has been seeking access to Mythos, the artificial intelligence developed by Anthropic, which specializes in detecting critical vulnerabilities. After several months of discussions, Anthropic has finally agreed to open its model to the European cybersecurity agency, ENISA. This decision marks a significant turning point, as it is the first time an EU institution has gained access to such a tool.

European Commission officials even traveled to San Francisco to negotiate this access, highlighting the strategic importance of Mythos. According to reports from Bloomberg and the Financial Times on June 1, the agreement has been reached, but the exact terms of this collaboration are still to be determined.

Conditional Access: Ongoing Negotiations

Anthropic's decision to share Mythos with ENISA is part of the Project Glasswing, an exclusive consortium launched on April 7, which includes prestigious partners such as AWS, Apple, Google, Microsoft, and NVIDIA. ENISA would thus become the first non-American and non-British public entity to access this model.

However, discussions are far from over. According to Laura Heuvinck, spokesperson for ENISA, the conditions for this access are still under negotiation. On the European Commission's side, Thomas Regnier, spokesperson for technological sovereignty, mentioned "productive meetings" with Anthropic, but did not provide further details. Nothing has been signed yet, and discussions continue to define the exact terms of this agreement.

The Stakes of Accessing European Infrastructures

ENISA's access to Mythos raises crucial questions about data sovereignty. By allowing a European agency to use such a powerful tool, Europe also gives Anthropic potential insight into its critical infrastructures. This friction point is central to the discussions: it is not just about what Europe gains, but also about what Anthropic might see.

Brussels, however, is not without resources. OpenAI recently launched its own cybersecurity model, GPT-5.4 Cyber, thus offering an alternative to European institutions. Furthermore, Europe is considering developing its own solutions. BNP Paribas is already collaborating with Mistral AI to create a sovereign alternative dedicated to banking cybersecurity, illustrating the continent's desire to reduce its dependence on American technologies.

Regulatory Impact and Implications for Europe

ENISA plays a key role in European cybersecurity, particularly in managing the vulnerability database mandated by the NIS2 directive. Access to Mythos would significantly enhance its capabilities, but it also raises concerns about dependence on American technologies.

The agreement with Anthropic does not resolve all issues. Once ENISA is able to use Mythos, other entities, such as national cybersecurity centers and the financial sector, may also demand direct access. The European Central Bank has already asked banks in the eurozone to address vulnerabilities identified by Mythos, underscoring the importance of this tool for financial security.

Persistent Dependence Despite Advances

While access to Mythos is a victory for Europe, it highlights its ongoing dependence on American technologies. The European Union regulates, taxes, and oversees tech giants, but still relies on them for its cybersecurity needs. The green light from Washington remains an essential prerequisite.

Unless initiatives like that of Mistral AI lead to significant breakthroughs, Europe's strategic autonomy in this area will still depend on transatlantic negotiations. This situation underscores the need for Europe to develop its own capabilities to ensure its digital sovereignty.