What happened on 11 May 2026
On Monday 11 May 2026, the European Commission confirmed an announcement that went relatively under the radar of the French press, but which landed like an earthquake in the corridors of Brussels. OpenAI has officially offered the European Union access to GPT-5.5-Cyber, a specialised version of its new model, designed for cybersecurity.
Thomas Regnier, spokesperson for the European Commission, welcomed OpenAI's transparency. European institutions (including the EU AI Office), cybersecurity authorities, governments and certain strategic European companies will therefore be able to test the model within a supervised framework.
But what makes the announcement truly striking is what it reveals by contrast: Anthropic, its direct competitor, refuses to grant the same access to its own cybersecurity model, Claude Mythos. And Europe is beginning to understand that it has a problem.
What are GPT-5.5-Cyber and Claude Mythos?
To understand what is at stake, you need to know what these two models are. As we mentioned in our article on Claude Mythos, they are AIs specialising in cybersecurity, capable of highly advanced tasks:
- Automatic detection of vulnerabilities across millions of lines of code
- Analysis of malicious software and reverse engineering of malware
- Automated pentesting (simulating attacks to test defences)
- Validation of security patches in minutes instead of several weeks
Independent tests by the UK AI Security Institute have measured the raw power of these models. On a test simulating a 32-step corporate cyberattack (which no AI had ever managed to complete before 2026), Claude Mythos succeeded 3 times out of 10. GPT-5.5 succeeded 2 times out of 10. To give a sense of scale: an experienced human hacker takes several days to carry out that same attack. The models do it in minutes.
What a defender can do with these tools, an attacker can do too. Finding a flaw in a banking system used to take a team of hackers weeks. It now takes a few hours with Mythos or GPT-5.5-Cyber. If these tools fall into the wrong hands, they radically transform the nature of cyberattacks. That is precisely why their distribution is so tightly controlled.
The two philosophies in conflict
OpenAI and Anthropic have chosen two opposing strategies for managing the risk of proliferation.
OpenAI has opted for controlled openness. Its programme is called Trusted Access for Cyber (TAC) and already counts thousands of verified defenders and hundreds of teams protecting critical infrastructure. The logic: the more the tool is distributed to the good guys, the greater the chances that the bad guys are detected and neutralised. OpenAI's European programme notably includes Deutsche Telekom and BBVA.
Anthropic has opted for strict restriction. Its programme is called Project Glasswing and has only 12 launch partners plus 40 additional organisations. The launch partners are AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, Nvidia, and a few others. All are American, and all have signed a strict commitment to defensive use only. The logic: a tool this powerful must stay within an ultra-restricted circle, otherwise the risk of a leak is too great.
Ironically, despite these precautions, sources suggest that an unauthorised group may already have managed to gain access to Mythos. Which shows the practical limits of the lock-down strategy.
| Criterion | OpenAI GPT-5.5-Cyber | Anthropic Mythos |
|---|---|---|
| Access programme | Trusted Access for Cyber (TAC) | Project Glasswing |
| Number of organisations with access | Thousands (open programme) | ~52 (restricted) |
| 32-step test (UK AI Security Institute) | 2/10 successes | 3/10 successes |
| European Union access | Yes (May 2026) | Refused |
| Enhanced verification required | Advanced Account Security (June 2026) | Manual validation by Anthropic |
The Bundesbank warning that changes everything
The most worrying development in the affair comes from the German Bundesbank, Germany's central bank. In a recent public intervention, it explicitly urged the European Union to demand access to Mythos from Anthropic, with a chilling argument: "European banks cannot defend themselves against AI-enabled threats without this access."
To understand the weight of this warning, it helps to know that in the United States, meetings have already taken place between the CEOs of the major American banks, Jerome Powell (Chair of the Federal Reserve), Scott Bessent (Treasury Secretary), and JD Vance (Vice-President). All of these meetings focused on the implications of Mythos for the American financial system. American banks have access to Mythos. European banks do not.
In practice, this means that an American bank can now, thanks to Mythos, identify and fix its own vulnerabilities before an attacker exploits them. A French or German bank without the same tool is therefore structurally more vulnerable. If an attacker equipped with an equivalent model (obtained, for example, through a leak or Chinese development) launches a coordinated campaign against European banks, the latter will be at a disadvantage.
This situation reveals an uncomfortable reality: European banking cybersecurity now depends on a private American laboratory, which decides unilaterally who gets access to its tool. If Anthropic continues to refuse access to Mythos, Europe must develop its own equivalent (probably at Mistral or a European consortium), or accept a permanent asymmetry vis-à-vis the United States. Neither option is comfortable.
Why is Anthropic holding out?
Anthropic's position deserves to be understood, not merely criticised. The company believes that Mythos is so powerful that, if it fell into the wrong hands, it could trigger an unprecedented wave of cyberattacks. For Dario Amodei (CEO of Anthropic), controlled distribution is not a commercial whim, it is a civilisational security obligation.
This position is consistent with Anthropic's DNA. As we explored in our article on the problem of AI control, Anthropic is the company that invests the most in safety and alignment. Refusing to distribute Mythos widely is consistent with that philosophy.
Sam Altman (CEO of OpenAI), for his part, has publicly criticised this approach, calling Anthropic's strategy "fear marketing". But ironically, OpenAI ended up applying the same logic of restriction for GPT-5.5-Cyber, in an attenuated form.
What this changes for Europe and France
Access to GPT-5.5-Cyber for European institutions is good news, but it is insufficient good news. Three concrete consequences follow from it.
First, Europe gains time to understand the scale of the risk. European authorities will be able to test GPT-5.5-Cyber and calibrate their defences accordingly. It is better than nothing.
>>Second, Europe must accelerate its own development. As we documented in our article on France's lag, Europe has all the talent needed to develop its own cyber model. Mistral AI has already announced a specialised model for 2027. But that timing is probably too late given how fast AI cyber capabilities are evolving.
Third, this affair proves that European digital sovereignty can no longer be a slogan. When an American lab can unilaterally decide whether or not to grant access to a tool critical to the defence of European banks, that is no longer commercial dependency, it is strategic dependency. Europe must learn the lessons.
The asymmetry taking shape for 2026-2027
If we extrapolate current trends, here is what looms over the next 18 months. The United States will continue to distribute these tools internally with enhanced vetting programmes. Major banks, telecoms operators and critical American infrastructure will be protected. Europe will have partial access via OpenAI, but probably with a capability lag of several months on new models.
Meanwhile, as we showed in our article on the US-China AI war, China is developing its own equivalents (notably at Qwen and DeepSeek), but with very broad government distribution. The risk is that eventually a Chinese or Russian state actor will have a cyber tool equivalent to Mythos, and that European banks will find themselves caught in a pincer movement: less well defended than their American counterparts, facing attackers just as well equipped.
The announcement of 11 May 2026 therefore marks a turning point. For the first time, Europe is publicly discovering that it depends on a private American lab for its own cybersecurity. The tug of war between European regulators, Anthropic and OpenAI has only just begun. And it will probably shape the future of European digital sovereignty more than all the policy plans stacked up over the past five years.