The European Union is getting access to OpenAI’s cyber model GPT-5.5-Cyber. Anthropic’s Mythos, on the other hand, remains behind closed doors. That’s according to CNBC on Sunday — and the story says a lot about the two AI giants’ contrasting strategies.
OpenAI Opens the Door
OpenAI announced it would grant European partners access to GPT-5.5-Cyber. That includes businesses, governments, cyber authorities, and EU institutions like the EU AI Office. In the US, the model had only been available to verified security researchers since last week — now the circle is expanding significantly.
It’s a smart move. The EU is actively working on AI regulation, and giving regulators early access lets you help shape the conversation. OpenAI is positioning itself as a cooperative partner — an image the company doesn’t always find easy to maintain.
Anthropic Holds Back Mythos
Anthropic’s Mythos was unveiled a month ago and has since sent shockwaves through the cybersecurity industry. The model found nearly 300 vulnerabilities in Firefox alone, with the total count across all software running into the tens of thousands.
That’s precisely what makes this complicated. Anthropic deliberately restricted Mythos access to a small circle — fearing that attackers could weaponize the model for cyberattacks. CEO Dario Amodei has repeatedly spoken of a ‘moment of danger.’
The EU Commission is negotiating with Anthropic for access, but according to CNBC, the talks are at a ‘different stage’ than those with OpenAI. Translation: it’s going to take a while.
Two Strategies, One Dilemma
OpenAI and Anthropic face the same problem: their models can help both defenders and attackers. But they’re handling it in completely different ways.
OpenAI bets on openness and cooperation with authorities. Anthropic bets on caution and controlled access. Both approaches have merit — and both have blind spots.
The interesting question is: what happens when the EU puts pressure on Anthropic? The AI Act gives European regulators real leverage. And a model that finds thousands of vulnerabilities but is only accessible to a handful of companies doesn’t fit particularly well with Europe’s ideal of digital sovereignty.
Sources: