ENISA Meets Anthropic on Mythos: EU Joins Project Glasswing (June 18, 2026)
ENISA Meets Anthropic on Mythos: EU Joins Project Glasswing (June 18, 2026)
The European Union Agency for Cybersecurity (ENISA) meets Anthropic in San Francisco on Thursday, June 18, 2026 to formalize the EU’s access to Claude Mythos via Project Glasswing. ENISA becomes the first EU agency inside the controlled-preview program that has so far included AWS, Apple, Google, Microsoft, NVIDIA, CrowdStrike, and JPMorgan Chase. Here’s what it means.
Last verified: June 18, 2026.
TL;DR
- What: ENISA-Anthropic meeting in San Francisco, June 18, 2026, confirmed by the European Commission on June 17.
- Outcome expected: ENISA gets Glasswing-tier access to Mythos for defensive cybersecurity research.
- Significance: First EU agency formally inside Glasswing. Operational follow-through to G7 Evian “trusted partners” framework.
- Scope: Defensive cybersecurity only. Does not extend Mythos access to EU companies.
- Regulatory link: Sets the operational baseline for EU AI Act Article 55 enforcement starting August 2026.
What is happening on June 18, 2026
European Commission spokesperson for Tech Sovereignty Thomas Regnier confirmed on June 17, 2026 that ENISA will meet Anthropic in San Francisco the following day. The meeting was first reported by Reuters and Bloomberg in early June, and is the formalization of weeks of EU-Anthropic negotiation. The European Commission described prior conversations with Anthropic as “productive.”
The meeting outcome — based on the public reporting — is ENISA’s inclusion in Project Glasswing.
What Project Glasswing is
Anthropic launched Project Glasswing on April 7, 2026 as a controlled-preview program for Claude Mythos, the frontier-capability model line. The program has these characteristics:
| Attribute | Detail |
|---|---|
| Launch | April 7, 2026 |
| Initial partners | ~50 organizations including AWS, Apple, Google, Microsoft, NVIDIA, CrowdStrike, JPMorgan Chase |
| Allowed use | Defensive cybersecurity only — vulnerability research, exploit detection, patching |
| First-month results (May 22 report) | 23,019 vulnerabilities found across 1,000+ open-source projects; 90.6% confirmed real on independent sampling |
| Model | Claude Mythos (frontier capability tier) |
| Geography | US-centric until ENISA |
The defensive-cybersecurity-only mandate is the legal scaffold that lets Anthropic offer Mythos access at all under the broader US export-control framework. Glasswing exists specifically because broad commercial Mythos access is suspended.
Why this matters now
Until June 17, 2026, no EU agency had Glasswing-tier access to Mythos. The political backdrop:
- Germany had initiated dialogue with Anthropic but had not obtained testing privileges as of early June.
- Spain’s economy minister described the pace of negotiations as “limited” on May 22, 2026.
- The June 12, 2026 US export-control order suspended broad Mythos and Fable 5 access globally, leaving Glasswing as the only formal channel.
- The EU AI Act’s risk-classification provisions take effect in August 2026, and the Commission had been increasingly explicit that it could not credibly enforce Article 55 systemic-risk obligations without independent technical access.
ENISA’s inclusion in Glasswing solves all of these. The EU gets first-hand technical evaluation, the political optics flip from “EU left out” to “EU at the table,” and the EU AI Act gains an operational evaluation pipeline before the August 2026 milestone.
Comparison: Glasswing partner tiers
| Partner type | Examples | Access scope |
|---|---|---|
| US hyperscalers | AWS, Microsoft, Google | Defensive cyber research, infrastructure hardening |
| US enterprise | JPMorgan Chase, CrowdStrike | Sector-specific vulnerability research |
| OS / device | Apple | Platform security research |
| Chips & infra | NVIDIA | Hardware-software security |
| Regulators | ENISA (as of June 18, 2026) | Independent risk assessment for EU AI Act |
ENISA’s profile is unique — it is the first regulator in the program. That sets a precedent for ANSSI (France), NCSC (UK), BSI (Germany), and CISA (US) to request similar arrangements. Expect at least one of those to follow before the end of Q3 2026.
What this does NOT change for EU builders
- EU companies cannot use Mythos. ENISA’s access is for the agency, not for downstream commercial deployment.
- The June 12, 2026 US export-control order remains in effect. Broad commercial Mythos and Fable 5 access stays suspended.
- Production options stay the same: Claude Opus 4.7, Sonnet 4.5, Haiku 4.5 for Anthropic; Kimi K2.7 Code for open-weight coding; DeepSeek V4 for open-weight general use; GPT-5.5 and Gemini 3.5 Pro for closed alternatives.
What this does change for EU regulation
- EU AI Act Article 55 enforceability is materially stronger. ENISA can produce independent systemic-risk evaluations rather than relying on lab self-reports.
- The “trusted partner” framework adopted in the G7 Evian declarations becomes operational. ENISA-Anthropic is the first concrete example.
- EU sovereign-AI political cover increases. The optics that the EU is now inside the frontier conversation reduce pressure for a Brussels-led capability moratorium.
- Other EU agencies will follow. Expect ANSSI, BSI, and possibly the Italian AgID to model their own access requests on the ENISA template.
Honest caveats
- The Glasswing scope is narrow. Defensive cybersecurity only. Anything ENISA evaluates is bound by that mandate.
- No public details on the access agreement. The exact technical access tier (full Mythos, Mythos 5, Mythos-via-API) has not been published.
- Geopolitics remain in flux. The June 12 US export-control order could be expanded or relaxed at short notice, which would change the Glasswing scaffold.
- ENISA’s capacity is constrained. ENISA has a small headcount relative to its mandate. Direct Mythos evaluation work will likely be subcontracted to EU national-CSIRT teams.
Sources
- Reuters, “EU cybersecurity agency to meet Anthropic on Thursday, EU Commission says,” June 17, 2026.
- Bloomberg, “Anthropic to Give Mythos Access to EU Cybersecurity Agency ENISA,” June 1, 2026.
- Dark Reading, “Anthropic to Open Mythos AI to EU’s ENISA,” June 4, 2026.
- MLQ.ai, “Anthropic Grants EU Cybersecurity Agency ENISA Access to Mythos AI Model,” June 2, 2026.
- WaveSpeed Blog, “June 2026 AI Launch Wave,” June 2026 — Project Glasswing first-month report details.
Related pages
- G7 Evian Summit AI Outcomes vs EU AI Act vs US Export Controls
- Fable 5 / Mythos 5 Export Control Suspension
- Synthetic DNA Screening AI Bioweapons CEO Letter
- AI Mode EU Sovereignty: Mistral vs US Frontier
This page summarises a June 17–18, 2026 development. We will update with details after ENISA or Anthropic publish a public readout.