EU Cybersecurity Agency Gains Access to Anthropic's Mythos 5 AI Model

This development signals a critical shift in the EU's approach to AI-driven cybersecurity, emphasizing the need for sovereign capabilities in technology assessment.

• On September 10, 2026, the European Union's cybersecurity agency ENISA gained access to Anthropic's Mythos 5 AI model.
• This access follows negotiations between the European Commission and Anthropic, aimed at addressing EU concerns over AI-related cyber risks.
• ENISA joins Project Glasswing to test the model's capabilities, while access to the updated Mythos 5.1 remains restricted due to US export controls.

• Mythos 5 was launched in April 2026 as an AI model designed to identify and exploit cybersecurity vulnerabilities at scale, initially limited to about 50 organizations.
• Geopolitical tensions arose from US export controls, which restricted foreign access to advanced AI models, prompting the EU to demand equitable access.
• The European Commission's engagement with Anthropic reflects a broader strategy to enhance the EU's cybersecurity posture and reduce reliance on external technology providers.

The European Union's access to Anthropic's Mythos 5 model represents a significant step in addressing the growing concerns surrounding AI-driven cybersecurity threats. Following its launch in April 2026, Mythos 5 was initially made available to a select group of organizations through Project Glasswing, which aimed to explore the model's capabilities in identifying and exploiting vulnerabilities. The initial access was limited to approximately 50 organizations, primarily composed of major US technology firms and select international entities.

However, the geopolitical landscape complicated matters. The US government's export controls imposed restrictions on the international sharing of advanced AI models, including Mythos 5. This situation prompted the European Commission to engage in negotiations with Anthropic to secure access for the European Union's cybersecurity agency, ENISA. The negotiations were lengthy, reflecting the complexities of international technology transfer and the strategic importance of cybersecurity in the current global landscape.

On September 10, 2026, ENISA was granted access to Mythos 5, allowing the agency to commence testing the model's capabilities. This access is particularly crucial as the EU seeks to understand and mitigate potential risks posed by AI technologies to critical infrastructure. The engagement has been described as constructive by the European Commission, emphasizing the importance of understanding the risks associated with AI models.

Despite this progress, access to the updated Mythos 5.1 variant remains withheld due to ongoing US policy limitations. This situation underscores the continued influence of US regulations on the distribution of advanced AI technologies and highlights the EU's need for sovereign testing capabilities. The EU's push for equitable access to AI models is not just about technology; it is also about ensuring that European entities can effectively assess and respond to emerging cyber threats.

As ENISA begins its testing phase, the implications for cybersecurity practices across the EU could be profound. The ability to leverage advanced AI models like Mythos 5 may enhance the EU's overall cybersecurity posture, enabling organizations to better identify vulnerabilities and respond to threats. However, the ongoing restrictions on access to the latest iterations of the model may hinder the EU's ability to fully capitalize on these advancements.

• Cybersecurity professionals: They will gain insights into advanced AI capabilities for vulnerability assessment.
• Tech companies in the EU: Enhanced access to AI tools could improve their cybersecurity measures and competitive edge.
• Regulatory bodies: They will need to adapt to new frameworks for AI governance and risk management.

• ENISA's testing outcomes: The results will indicate how effectively Mythos 5 can enhance cybersecurity measures across the EU.
• US policy changes: Any shifts in US export controls could impact the availability of advanced AI models for EU entities.
• Expansion of Project Glasswing: The inclusion of more partners could lead to broader insights and applications of AI in cybersecurity.