In September 2026, the European Commission confirmed that ENISA—the EU cybersecurity agency—gained access to Anthropic Mythos under the restricted Project Glasswing program. Coverage dated around 10 September and echoed through the month closed months of talks on how a frontier lab shares its most sensitive model with a European public evaluator.
Project Glasswing is not an open marketplace. It is a controlled-access scheme aimed at defensive research: testing cybersecurity capabilities, mapping misuse risks, and feeding evaluations without turning the model into a general product for every European administration.
Version nuance matters. Per coverage and Anthropic documentation, ENISA’s grant centers on Mythos 5. Mythos 5.1, introduced in early September as a more capable update still invite-only for Glasswing participants, does not automatically equal the same access package. That caveat prevents celebrating “full access” the sources do not support.
For Brussels, the episode is both symbolic and operational. Symbolic, because it casts the EU as an interlocutor able to demand real evaluation of frontier systems. Operational, because ENISA needs cutting-edge models to anticipate attack vectors that no longer fit 2024 benchmarks.
Anthropic, for its part, gains a cooperation channel with European regulators just as the AI Act demands documentation, post-market monitoring, and serious-incident response capacity. Sharing under Glasswing does not erase legal duties; it may preempt compliance friction.
Negotiating access is non-trivial: weight or API custody, prompt logging, network isolation, cleared staff, and redistribution limits. Each clause reflects the tension between research utility and capability-leak risk.
Timing also speaks. After roughly three months of intense talks, access arrives when Europe’s summer already piled alerts about agents escaping sandboxes and models used in offensive probing. ENISA is late relative to political desire, not late relative to technical need.
Independent researchers warn that institutional access does not replace truly independent third-party audits. ENISA is a public actor with a mandate; it is not a citizen red team. Both roles are necessary and not interchangeable.
In the market, the message to other labs is competitive: offering Glasswing-like paths to government evaluators can reduce political distrust. Refusing altogether may invite more aggressive AI Office RFIs.
In public narrative, Mythos has been treated as Anthropic’s most sensitive system. Any access, however restricted, redefines who can measure its limits. That changes threat tables for national CERTs that previously saw only commercial demos.
Neural Pulse stresses the declared scope: controlled defensive evaluation, not mass deployment across ministries or a public European API. Confusing ENISA access with general EU adoption of Mythos would be a misread.
Synchronization with 5.1 remains open. If the capability frontier moves every few weeks, a public evaluator that only sees version N-1 always carries structural lag. Glasswing must show it can rotate access at lab speed.
For Europe’s cybersecurity industry, value will sit in findings published or shared under control: jailbreak patterns, tool abuse, and containment failures. Without that knowledge outflow, access would be theater.
The deeper implication is techno-geopolitical: the EU no longer settles for reading alignment papers; it demands a seat in front of the model. Glasswing is the first seat—not the end of the road.
