Executive Summary
Anthropic’s decision on 7 April 2026 to withhold Claude Mythos Preview from general commercial release, and to distribute it through the Project Glasswing consortium of twelve named partners and more than forty additional organisations, marks the first operational instance of a frontier artificial intelligence (AI) cyber capability governed exclusively through private architectures. The model’s empirically demonstrated capacity to identify thousands of high-severity zero-day vulnerabilities, including a seventeen-year-old flaw in FreeBSD, and to autonomously execute a thirty-two step network compromise indicates that advanced offensive cyber capability has migrated from state signals-intelligence agencies into general-purpose AI systems. Existing UK and European Union (EU) critical infrastructure frameworks, which include the Network and Information Systems 2 Directive (NIS2), the Cyber Resilience Act, the AI Act and the Cyber Security and Resilience Bill, presuppose state-centric coordination. This Brief sets out four concrete policy adjustments to align these instruments with a balanced offense-defence approach.
Introduction
On 7 April 2026 Anthropic announced that Claude Mythos Preview, a model its own Frontier Red Team described as capable of surpassing all but the most skilled humans at vulnerability discovery and exploitation, would not be made generally available (Anthropic, 2026a). Distribution would instead proceed through Project Glasswing, a consortium comprising twelve named partners, among them Amazon Web Services, Apple, Cisco, CrowdStrike, Google, JPMorganChase, Microsoft, NVIDIA and Palo Alto Networks, together with more than forty organisations selected on criteria Anthropic has not publicly disclosed (Anthropic, 2026a). The UK AI Security Institute (AISI) confirmed that the model achieves a 73 per cent success rate on expert-level capture-the-flag tasks and is the first system to autonomously complete AISI’s “The Last Ones” thirty-two step network compromise simulation (AISI, 2026a).
The arrangement constitutes the first operational instance at scale of a private consortial governance regime for an AI cyber capability that the producing firm has itself classified as too dangerous for general release. Project Glasswing is illustrates a structural shift: the historic nation-state near monopoly on advanced offensive cyber capability has eroded, and the architecture replacing it sits outside the institutional channels through which UK and EU critical infrastructure security has been governed.
Analysis
The Empirical Migration of Capability
Historically advanced offensive cyber capability has been concentrated in a small number of state signals-intelligence agencies, the US National Security Agency’s Tailored Access Operations, the UK’s GCHQ, Israel’s Unit 8200, and equivalents in the People’s Republic of China and the Russian Federation. Smeets (2022) demonstrates that even among the approximately forty states with declared cyber commands, only a handful have assembled the People, Exploits, Toolsets, Infrastructure and Organisation (PETIO) necessary for sustained offensive operations. Building such forces has been slow, expensive and dependent on tacit knowledge transfer that resists scaling.
Claude Mythos Preview substitutes for three of the five PETIO inputs simultaneously. The Anthropic Frontier Red Team identified thousands of high-severity vulnerabilities across major operating systems and web browsers, including a seventeen-year-old remote code execution flaw in FreeBSD and a long-undetected vulnerability in FFmpeg that automated testing tools had failed to surface despite five million prior runs (Anthropic, 2026b). AISI’s independent evaluation places autonomous cyber capability on a doubling trajectory of approximately 4.7 months, with Mythos exceeding the extrapolated trend (AISI, 2026c). The empirical conclusion is that a private firm has produced, in a development cycle measured in years rather than decades, an operational capability that states required generational investment to assemble.
The Structural Argument For Erosion
The capability shift implies an inversion of the cyber offence-defence balance. Slayton (2017) argues that offence dominance in cyberspace flows from organisational skill in managing software complexity, precisely the bottleneck that frontier AI compresses. Garfinkel and Dafoe (2019) formalise this dynamic through an “offensive-then-defensive scaling” model, where large investment increases in cyber initially favour the offence, with defensive parity restored only at higher levels of accumulated capacity. The compute and training investment associated with frontier AI is, by an order of magnitude, the largest such surge in the history of cyber. The 2026–2028 window therefore represents the period of greatest projected offensive advantage.
This erosive process observed is not theoretical, and is reflected by endeavours by other firms. OpenAI launched its Trusted Access for Cyber programme in February 2026, with GPT-5.5-Cyber following in May, and AISI has confirmed that the OpenAI model independently replicated the “The Last Ones” result within seventeen days of Mythos (AISI, 2026b; OpenAI, 2026). The presumption that a frontier AI cyber capability can be confined to a single firm has thus failed within weeks of its first test.
The Governance Vacuum
UK and EU critical infrastructure frameworks were designed for a world in which advanced offensive capability resided with states and could be addressed through diplomatic, sanctions and disclosure mechanisms between states. NIS2 imposes risk-management, supply-chain and coordinated vulnerability disclosure obligations on essential and important entities, but reaches AI providers only indirectly through downstream contracting (European Parliament and Council, 2022, Article 21). The Cyber Resilience Act, whose reporting obligations enter force on 11 September 2026, applies to products with digital elements but largely exempts AI models distributed through application programming interfaces, the principal mode of frontier model deployment (European Parliament and Council, 2024a). The AI Act’s Article 55 obligations on general-purpose AI models with systemic risk become fully enforceable on 2 August 2026, but the operative framing is one of safety reporting to the European Artificial Intelligence Office, not co-determination of capability access (European Parliament and Council, 2024b). In the UK, the Cyber Security and Resilience Bill currently before Parliament expands the NIS framework but remains silent on AI-discovered vulnerabilities (Department for Science, Innovation and Technology, 2025).
The institutional venue in which a Glasswing-type initiative would conventionally have been situated, i.e, the public-private operational coordination model exemplified by the US Joint Cyber Defense Collaborative, has itself contracted. Geller (2025) reports that the Collaborative’s principal contract lapsed in July 2025, reducing its contractor headcount from over one hundred to ten. The hollowing of the state-led counterpart occurred precisely as the private consortial model consolidated.
Counterarguments
Three counterarguments require enhanced engagement. First, it can be argued that Anthropic’s gated distribution is itself a form of responsible governance, exceeding what state actors typically achieve. The point has force but is more procedural rather than constitutional, i.e., it concerns the conduct of a single firm, not the legitimacy of the underlying authority to scope critical software, allocate access and set timelines unilaterally. Second, it can be argued that comparable capabilities will proliferate regardless, rendering governance interventions futile. The replication evidence supports the premise but inverts the conclusion: rapid proliferation strengthens the case for binding state involvement at the design stage rather than after the fact. Third, it can be argued that state-led alternatives such as the Joint Cyber Defense Collaborative have proven brittle. The contraction is real but reflects political contingency rather than structural infeasibility, with the lesson being that hard governance proposals require restored state capacity, not their abandonment.
Policy Recommendations
- Binding cyber-capability evaluation. The European Artificial Intelligence Office and AISI should establish mandatory standing offensive-cyber evaluations for general-purpose AI models above the 10²⁵ floating-point operation threshold defined in Article 51 of the AI Act, with bright-line capability thresholds equivalent to those Anthropic applies to chemical, biological, radiological and nuclear risks under its Responsible Scaling Policy (Anthropic, 2025). Voluntary AISI access arrangements should be placed on a statutory footing through amendment to the Cyber Security and Resilience Bill.
- AI-discovered vulnerability disclosure. Article 14 of the Cyber Resilience Act should be amended, or its scope clarified through implementing guidance from the European Union Agency for Cybersecurity (ENISA), to require providers of frontier general-purpose AI to submit AI-discovered vulnerabilities against products in the EU market to the European Vulnerability Database. The same requirement should be mirrored under NIS2 Article 12 coordinated vulnerability disclosure procedures.
- Pall Mall Process extension. The UK Cabinet Office, the French Ministry for Europe and Foreign Affairs, and signatories to the Pall Mall Declaration should extend the Process’s scope to AI-Enabled Cyber Intrusion Capability as a category alongside existing commercial intrusion categories. Frontier AI providers should participate on equal footing with traditional vendors of commercial cyber intrusion capabilities.
- Procurement-conditioned observer access. Public-sector procurement of frontier AI for national security purposes should be conditioned on state observer seats in private safety consortia. The Procurement Act 2023 in the UK, and EU public procurement directives, provide the legal basis. Observer access affords AISI and ENISA insight into consortium evaluation records, red-team results and access criteria without disrupting commercial operations.
References
AI Security Institute (2026a) Our evaluation of Claude Mythos Preview’s cyber capabilities. Available at: https://www.aisi.gov.uk/blog/our-evaluation-of-claude-mythos-preview-cyber-capabilities (Accessed: 19 May 2026).
AI Security Institute (2026b) Our evaluation of OpenAI’s GPT-5.5 cyber capabilities. Available at: https://www.aisi.gov.uk/blog/our-evaluation-of-openais-gpt-5-5-cyber-capabilities (Accessed: 19 May 2026).
AI Security Institute (2026c) How fast is autonomous AI cyber capability advancing? Available at: https://www.aisi.gov.uk/blog/how-fast-is-autonomous-ai-cyber-capability-advancing (Accessed: 19 May 2026).
Anthropic (2025) Responsible Scaling Policy, version 3.0. Available at: https://www.anthropic.com/news/responsible-scaling-policy-v3 (Accessed: 19 May 2026).
Anthropic (2026a) Project Glasswing: Securing critical software for the AI era. Available at: https://www.anthropic.com/glasswing (Accessed: 19 May 2026).
Anthropic (2026b) Claude Mythos Preview. Anthropic Frontier Red Team. Available at: https://red.anthropic.com/2026/mythos-preview (Accessed: 19 May 2026).
Department for Science, Innovation and Technology (2025) Cyber Security and Resilience (Network and Information Systems) Bill. London: HMSO.
European Parliament and Council (2022) Directive (EU) 2022/2555 on measures for a high common level of cybersecurity across the Union (NIS2 Directive). Official Journal of the European Union, L 333, 27 December 2022.
European Parliament and Council (2024a) Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union, 20 November 2024.
European Parliament and Council (2024b) Regulation (EU) 2024/1689 laying down harmonised rules on artificial intelligence (AI Act). Official Journal of the European Union, 12 July 2024.
Garfinkel, B. and Dafoe, A. (2019) ‘How does the offense-defense balance scale?’, Journal of Strategic Studies, 42(6), pp. 736–763.
Geller, E. (2025) ‘CISA’s Joint Cyber Defense Collaborative takes major personnel hit’, Cybersecurity Dive, 30 July. Available at: https://www.cybersecuritydive.com/news/cisa-joint-cyber-defense-collaborative-contract-lapse/756231/ (Accessed: 19 May 2026).
OpenAI (2026) Scaling Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber. Available at: https://openai.com/index/gpt-5-5-with-trusted-access-for-cyber/ (Accessed: 19 May 2026).
Slayton, R. (2017) ‘What is the cyber offense-defense balance? Conceptions, causes, and assessment’, International Security, 41(3), pp. 72–109.
Smeets, M. (2022) No shortcuts: Why states struggle to develop a military cyber-force. London: Hurst.