Europe’s Cybersecurity Wake‑Up Call: Why AI Dependency Is a Strategic Vulnerability

For years, the debate over European technological sovereignty has focused on cloud infrastructure, semiconductors, and data protection. But the June 2026 decision by the United States to block non‑US citizens from accessing Anthropic’s most advanced AI models – Fable 5 and Mythos 5 – has opened a new and far more urgent front: cybersecurity dependence.

The order, issued by the US Commerce Department, forced Anthropic to abruptly disable both models for all foreign nationals, including its own non‑American employees. “The net effect of this order is that we must abruptly disable Fable 5 and Mythos 5 for all our customers to ensure compliance,” the company said. The directive was not targeted at any specific country but applied to every user outside the United States, covering allied nations, EU institutions, and paying subscribers alike.

This is not a dispute over a chatbot. It is a decisive moment in the geopolitics of artificial intelligence – and it reveals a dangerous structural vulnerability in Europe’s ability to defend itself in the digital domain.

Table of Contents

• What Is Mythos and Why Does It Matter?
• Why This Matters for European Cybersecurity
• The EU’s Dilemma: Access vs Sovereignty
• The Mythos Paradox
• The Path Forward: What Europe Must Do
• Conclusion: A Strategic Imperative

What Is Mythos and Why Does It Matter?

Mythos is not an ordinary AI model. Unlike systems designed for conversation or content generation, Mythos was built specifically for cybersecurity. It can analyse complex codebases, identify software vulnerabilities, and even develop working exploits. Anthropic itself described it as a frontier cyber model capable of finding security flaws across operating systems, browsers, and critical infrastructure software.

Because of its power, Anthropic initially withheld Mythos from public release. Instead, it created Project Glasswing: a controlled access programme that allowed a limited set of trusted organisations – including major tech companies and government bodies – to use Mythos for defensive cybersecurity.

Fable 5, launched just days before the US order, was marketed as a safer, “locked‑down” version of Mythos. It contained safeguards designed to prevent users from accessing the model’s most sensitive offensive capabilities. However, the US government reportedly became aware of a method to bypass (“jailbreak”) those safeguards, raising concerns that Fable could be used for offensive cyber‑operations.

The Trump administration acted swiftly. Within hours of receiving the directive, Anthropic cut off access worldwide.

Why This Matters for European Cybersecurity

The immediate consequence of the US order is that European banks, hospitals, government agencies, and critical infrastructure operators that had been relying on Mythos or Fable were suddenly left without access. Some had been using these models to identify and patch vulnerabilities in their own systems.

The deeper consequence is structural. As former French Prime Minister Édouard Philippe noted, “AI is now a critical infrastructure, as essential as electricity or the Internet. An infrastructure whose models and computing power we do not control is an infrastructure that others can unplug”.

The EU’s own response confirmed the alarm. A European Commission spokesperson said the US move “further underlines Europe’s need for technological sovereignty”. EU spokesman Thomas Regnier added that the decision “demonstrates also the importance of our existing cybersecurity and AI legislation”.

But legislation alone cannot fill the capability gap. As Finnish MEP Aura Salla put it: “There have been enough wake‑up calls like this for Europe. Now it’s high time for action to make European tech sovereignty a reality”.

The EU’s Dilemma: Access vs Sovereignty

In early June 2026, the European Commission finally gained limited access to Mythos after weeks of difficult negotiations with Anthropic. The timing was unfortunate: barely two weeks later, the US order nullified much of the value of that access, because future access can now be withdrawn at Washington’s discretion.

Some European politicians drew a stark conclusion. French presidential candidate Bruno Retailleau called the US decision a “wake‑up call”, warning that “a nation that depends on others for its technology is a nation that can be unplugged overnight”. His rival, Gabriel Attal, wrote that “the AI war has already begun”.

Others, however, caution against simplistic “Europe versus America” narratives. As one cybersecurity expert argued, “Europe’s challenge is not to turn away from partners. It is to stop confusing partnership with dependency”. The goal should be European sovereignty through building credible European AI capacity, not through isolation.

The Mythos Paradox

A deeper paradox runs through the entire debate. The US government itself recognises that models like Mythos are indispensable cybersecurity tools. The Pentagon has been using Mythos to identify and patch vulnerabilities across US government systems. At the same time, Washington is now denying that same capability to its closest allies.

This creates a dangerous asymmetry. European defenders are being disarmed at the very moment when offensive cyber‑capabilities are proliferating elsewhere. As one commentator observed, “You cannot call Europe’s strongest defensive tool something we are ‘better off without’. ‘Better off without’ disarms only European defenders. That is not neutrality, it is one‑sided disarmament”.

The Path Forward: What Europe Must Do

The Anthropic crisis is not an isolated incident. It follows years of warnings about European dependence on US cloud providers, semiconductors, and now AI. Each episode follows a similar pattern:

1. A critical technology is developed outside Europe.
2. European organisations become dependent on it.
3. A geopolitical shock reveals the vulnerability.
4. Calls for sovereignty multiply – but action lags.

Breaking this cycle requires more than statements of intent. European policymakers and business leaders need to act on several fronts.

1. Accelerate European AI for Cybersecurity

The EU must dramatically increase investment in home‑grown frontier AI models specialised for cybersecurity. This includes funding for research, compute infrastructure, and the creation of “sovereign AI” capabilities that can operate independently of US or Chinese supply chains.

2. Create a European “Glasswing”

The Commission should establish a public‑interest access programme for advanced AI‑powered cybersecurity tools, modelled on Project Glasswing but under European control. This would ensure that critical infrastructure operators have access to state‑of‑the‑art defensive capabilities regardless of geopolitical developments.

3. Reform Procurement Rules

Public sector organisations and regulated industries must be required to assess critical dependencies in their AI and cybersecurity supply chains. Where strategic dependence on non‑European providers exists, migration plans and redundancy architectures should be mandatory.

4. Leverage the EU AI Act

The EU AI Act already provides a framework for regulating high‑risk AI systems, including those used in critical infrastructure. But the Act focuses on safety and fundamental rights – not on geopolitical supply‑chain risk. The next EU legislative cycle should address this gap.

5. Build a Transatlantic “Defensive AI” Agreement

While the US is unlikely to reverse its export control policy, there may be room for a targeted agreement that would allow trusted European entities (governments, CERTs, critical infrastructure operators) continued access to US‑origin cybersecurity AI models under strict conditions. Such an agreement would not resolve the underlying dependency but could buy time for Europe to build its own capabilities.

Conclusion: A Strategic Imperative

The US order against Anthropic’s Fable and Mythos models is not a misunderstanding or a minor regulatory dispute. It is a deliberate assertion that frontier AI models are strategic assets, to be controlled like nuclear technology or advanced weaponry.

For Europe, the implications are clear. The continent cannot rely on the continued goodwill of any foreign power for access to the most advanced cybersecurity tools. Cybersecurity is national security, and national security cannot be outsourced.

The EU has recognised the problem. It has spoken of technological sovereignty for years. But the gap between rhetoric and reality remains vast. The Anthropic crisis is not the first wake‑up call. It must not be the last.

As independent cybersecurity expert Lukasz Olejnik wrote: “Europe has seen this risk for years […] This is not the alarm. This is the bill for ignoring it”.

This analysis was published as part of our ongoing coverage of European digital sovereignty and AI policy.

Keywords: Anthropic Mythos, Fable 5, US export controls, European cybersecurity, AI sovereignty, digital sovereignty, critical infrastructure, cyber defence, EU AI Act, Project Glasswing, technological dependency, strategic autonomy