Anthropic has granted the European Union Agency for Cybersecurity (ENISA) access to its Mythos AI model through the “Project Glasswing” initiative, making ENISA the first EU institution to access the system. The agreement, finalized in early June 2026 after weeks of negotiations, allows ENISA to join a select group of organizations — primarily US-based firms like Microsoft, Apple, and Google — that have been utilizing Mythos for defensive cybersecurity testing.
Mythos, launched in April 2026 as Claude Mythos Preview, is purpose-built to autonomously identify security flaws in complex codebases and generate exploits. The model has reportedly discovered over 10,000 zero-day vulnerabilities in critical software across major operating systems and web browsers, including flaws in software essential for European banking systems, government networks, and critical infrastructure.
ENISA’s access is intended to enable the agency to assess and remediate potential vulnerabilities within European systems and to prepare for a new wave of powerful AI models capable of autonomous vulnerability discovery.
Sources
Commentary
Mythos sits at a fascinating and uncomfortable intersection of AI capability and cybersecurity. A model that can autonomously find and generate exploits for 10,000+ zero-days is arguably the most powerful offensive cybersecurity tool ever created. In the right hands, it’s a defensive superweapon that can patch vulnerabilities before attackers find them. In the wrong hands, it’s an exploit factory.
ENISA gaining access is both practically necessary and strategically important for European digital sovereignty. The EU can’t defend its infrastructure against AI-discovered vulnerabilities without access to the same tools finding them. As AI models become increasingly capable of autonomous offensive security research, every access decision Anthropic makes sets precedent for governing the most powerful dual-use technology of our era.