The European Commission has presented an action plan linking cybersecurity and artificial intelligence, with the aim of guaranteeing European businesses and public bodies access to the most advanced AI models for defending their systems.
The background
In April, the US company Anthropic announced Claude Mythos Preview, an AI model with an exceptional ability to find vulnerabilities in software. Because the same capability could be misused for cyberattacks, Anthropic chose not to make it publicly available, instead giving access to a small number of organisations through an initiative called Project Glasswing to help them find and fix security flaws.
Several governments, reportedly including Spain’s, showed interest in using such tools to secure their own systems and critical infrastructure.
In June, US export controls temporarily restricted access to some of the most advanced models outside the United States, including newly released Mythos-class models. The controls were lifted at the end of the month and access was restored, but the episode highlighted Europe’s dependence on technology developed elsewhere.
The EU’s response
The Commission says it will set out “clear and transparent conditions” to ensure “structured access” for public and private organisations to the generative AI tools considered essential for cybersecurity. Frontier models from US developers, including Anthropic’s Mythos models, are among those referred to in the plan.
The details — who would get access, on what terms and under what safeguards — have yet to be worked out.
Why it matters
AI tools that can scan code for weaknesses could help hospitals, banks, utilities and public administrations find and fix security holes before criminals exploit them. At the same time, the dual-use nature of these models means access needs to be carefully controlled.
For Europe, the debate is also about sovereignty: how to ensure its institutions are not left without critical defensive tools because of decisions taken in other countries, while also building up European AI capabilities of its own.
What comes next
The Commission will develop the details of the access framework in the coming months, in consultation with member states and industry. How it works in practice will depend on agreements with the companies that develop these models and on the policies of the governments where they are based.
