The European Commission is actively investigating the practical implications of Anthropic’s decision to deploy Claude Mythos, an advanced AI model with an unusual specialty: finding software vulnerabilities better than most human experts can. The review marks one of the most visible examples yet of Brussels asserting its regulatory muscle over a US-based AI company operating under Europe’s emerging AI governance framework.
Anthropic committed to the EU’s General-Purpose AI Code of Practice back in July 2025, positioning itself as a cooperative player ahead of the AI Act’s enforcement in August 2025. That goodwill is now being stress-tested as regulators try to figure out what it actually means when a foreign company builds a tool that can systematically uncover flaws in critical software infrastructure.
What Mythos does, and why Brussels cares
The model demonstrated capabilities in detecting software vulnerabilities that surpass most human analysts, as of April 2026 when its capabilities became more widely understood.
The European Commission confirmed it has held at least four or five meetings with Anthropic by May 2026, beginning in April 2026. Those discussions have reportedly focused on two tracks: risk mitigation strategies and potential access to Mythos for EU entities, including ENISA, the European Union Agency for Cybersecurity.
