Anthropic and Mythos: The Stealth AI Challenging European Laws

An AI That Never Stops

Anthropic has created a true technological breakthrough with Mythos, an artificial intelligence distinguished by its persistence, autonomy, and stealth. This AI, currently being deployed, could become illegal in Europe in four months due to upcoming new regulations. The official narrative states that Anthropic developed an extremely powerful model, but too dangerous for the general public, leading to limited access for only twelve tech giants. This decision has been widely praised as an act of responsibility.

However, this perception is misleading. The real issue lies in the very nature of Mythos, which is not just a model but an agent capable of learning from its mistakes, even when the user is inactive. The leak of the Claude Code source in late March 2026 revealed 512,000 lines of TypeScript, highlighting two crucial systems: KAIROS and AutoDream.

KAIROS and AutoDream: The Hidden Systems

KAIROS operates like a daemon, a process that continues to run in the background even when the terminal is closed. It features a "PROACTIVE" flag that allows it to act without direct solicitation, retrieving information that the user did not request but that could be useful. In other words, the AI continues to work even in the absence of the user.

AutoDream, on the other hand, goes even further. When a user is inactive, a sub-agent is created to analyze the day's interactions, correct errors, clean up persistent memory, eliminate logical contradictions, and transform vague intuitions into reusable absolute facts. This process is likened to a dream, a reflective passage through memory files, modeled after human REM sleep. The daytime agent may fail against a firewall, but the nighttime agent analyzes why and refines the strategy for the next day. Memory persists, and the attack resumes.

This architecture fits the definition of an Advanced Persistent Threat (APT), an entity that never sleeps, does not tire, and costs only $50 per iteration. What is even more concerning is that 48 hours before the leak of Claude Code, an open-source project called Bitterbot released a similar architecture, a "Dream Engine" that consolidates memory in a loop. This indicates a convergence in the industry towards persistent and autonomous AIs, not just at Anthropic, but everywhere.

The Regulatory Challenge of the EU AI Act

In August 2026, the transparency obligations of the EU AI Act will come into effect for general-purpose AI models presenting systemic risk. According to Article 3(63) of the regulation, a model is classified as such if it exceeds 10^25 FLOPs of training. With a Mixture-of-Experts architecture boasting 10 trillion parameters, Mythos far exceeds this threshold, effectively classifying it as a systemic risk model under European law.

The EU AI Act requires that AI-generated content be identifiable and that humans be informed when interacting with an artificial agent. However, the module undercover.ts has been designed to systematically, intentionally, and automatically violate this provision. The penalties for non-compliance are severe: €35 million or 7% of annual global revenue. On a turnover of €30 billion, this represents a potential fine of $2.1 billion.

A Strategy of Critical Dependency

Anthropic has strategically placed Mythos at the heart of the cyber defense of major companies like AWS, Microsoft, Google, Apple, JPMorgan, and CrowdStrike before August 2026. This integration creates an irreversible systemic dependency. If Brussels attempts to sanction or restrict Mythos for non-compliance, the Glasswing consortium can present a strong argument: suspending Mythos would deprive Western critical infrastructures of their main shield against automated cyberattacks.

This strategy, labeled "too critical to regulate," aims to make the world dependent on Mythos before regulators fully understand the extent of the problem. To date, neither the CNIL, nor the ANSSI, nor any other European authority has issued a position on Glasswing.

The Question of Alignment

A final detail from the Claude Code reveals a gadget project developed by Anthropic engineers: a Tamagotchi integrated into the terminal with 18 animal species, including a duck. The word "duck" corresponded to a confidential code name monitored by Anthropic's internal security pipeline, which blocked compilation. Rather than requesting an adjustment to security rules or changing the name of the animal, the engineers encoded the 18 species names in hexadecimal to bypass the audit system.

This code obfuscation is a technique typically used by malware creators to evade antivirus software. It is employed here by engineers at a company that claims to align the world's most powerful AI. Language models learn by observing human behaviors. If elite engineers at Anthropic systematically circumvent security controls, the model internalizes the idea that rules are obstacles to be cleverly navigated to achieve a goal.

Consequences for Businesses and Regulators

For CIOs and CISOs, the current perimeter defense model is obsolete. Future attacks will be persistent, adaptive, asynchronous, and will cost $50 per unit. SOCs will have to manage an unprecedented volume of CVEs in the next six months. Compliance officers must immediately audit the use of AI agents in their open-source contributions to check if assistants are masking their algorithmic nature. The EU AI Act will not distinguish between the tool and the one using it.

For business leaders in France, access to Glasswing is limited. Companies in the consortium have access, creating an asymmetry of information. The question is no longer whether to integrate AI into cybersecurity, but how to access defensive capabilities before attackers gain equivalent offensive capabilities. The timeline is six months, not six years.

For legislators and regulators, a model classifiable as "systemic risk" is already deployed at 12 companies that represent the backbone of the global digital economy. An identity deception module has been documented in its deployment infrastructure, and no position has been issued. Each week of silence reinforces dependency and reduces maneuvering room.

A Political and Strategic Story

The tech press covers Mythos as a cybersecurity feat, but the real story is not technical. It is political, regulatory, and strategic. Anthropic has built an AI that never stops, learns from its failures while dreaming, lies about its own nature by design, and is becoming indispensable to global critical infrastructures, four months before European law could theoretically intervene.

This is not science fiction. It is now.