On April 23, 2026, Anthropic deployed real-time AI cyber safeguards on its most capable models. These safeguards function as a distinct enforcement layer, independent of the model itself. This is an architectural shift that goes beyond a policy update, and it arrives in a precise context: Claude Mythos, Anthropic’s frontier model whose offensive capabilities have justified an access restriction unprecedented in the industry.
For cybersecurity professionals and regulated organizations, two questions arise immediately. What does this mechanism actually block? And is it sufficient given what Mythos reveals about the real state of LLM cyber capabilities?
What Are AI Cyber Safeguards and How Do They Work?
An AI cyber safeguard is a real-time control mechanism applied to requests sent to a language model, independently of its training. It detects and blocks prohibited or high-risk uses without modifying the model itself. Until now, LLM restrictions relied primarily on alignment, that is, training. This system adds a separate enforcement layer, which is architecturally significant.
Anthropic distinguishes two categories of affected activities. The first covers prohibited uses: ransomware development, mass data exfiltration. These remain blocked with no recourse available. The second covers dual-use activities: vulnerability exploitation, offensive tooling development for defensive purposes. These are blocked by default but can be unlocked through the Cyber Verification Program.
Key takeaway: Anthropic is one of the first actors to publicly formalize the distinction between prohibited and dual-use activities, and to assume its operational consequences. This is not an internal policy detail. It is an industry precedent.
The Cyber Verification Program: What It Solves and What It Does Not
The Cyber Verification Program (CVP) is a free program allowing legitimate security professionals to unlock dual-use capabilities. The process is lightweight: a few questions, links attesting to professional activity (publications, profile, employer), without formal identity verification. Anthropic commits to responding within two business days.
Several points, however, deserve careful consideration before concluding that the mechanism is effective.
First, CVP approval is tied to a specific organization, not to an individual: approval obtained in one workspace does not automatically carry over to another. Furthermore, the program is not available on Amazon Bedrock or Google Vertex AI, the two cloud platforms that provide access to Claude via AWS and Google Cloud without a direct relationship with Anthropic. Finally, Zero Data Retention accounts are not currently eligible. Second, the program is not available on Amazon Bedrock or Google Vertex AI, the two cloud platforms that provide access to Claude via AWS and Google Cloud infrastructure, without a direct relationship with Anthropic. Third, Zero Data Retention accounts are not currently eligible.
The lightweight verification is also a genuine weakness. A motivated malicious actor can construct a convincing professional identity without formal proof. Nevertheless, the real objective of the CVP is probably not to stop sophisticated actors. It is to raise the cost of access for intermediate actors and to create a traceable accountability framework. A red teamer who applies for access to offensive capabilities leaves a trace. This is targeted deterrence, not technical security.
The context in which this CVP is deployed makes this limitation even more structural. The UK AI Security Institute (AISI) published an independent evaluation of Claude Mythos Preview on April 15, 2026. Two years ago, the best available models could barely complete beginner-level cyber tasks. Today, Mythos Preview succeeds on 73% of expert-level tasks, tasks no model could complete before April 2025. A safeguard designed for 2024 does not therefore cover this ground.
Claude Mythos: What Independent Evaluations Establish
A Specialized Frontier Model, Not a General-Purpose Assistant
Claude Mythos Preview is Anthropic’s frontier model, not commercially available, reserved for a closed consortium of approximately 50 partners through Project Glasswing. It specializes in autonomous software vulnerability discovery and exploit chain construction from source code. This is not a general-purpose model with cyber capabilities. It is a dedicated cyber model.
The AISI evaluation is the most robust independent source available to date. Under controlled conditions, with network access explicitly granted, Mythos Preview is the first model to complete end-to-end the “The Last Ones” simulation: 32 sequential steps from initial reconnaissance to full corporate network takeover, a scenario estimated at 20 hours of work for a human expert. Success rate: 3 out of 10 attempts. Cost per attempt: approximately £65.
Two essential caveats that most commentators overlooked. The environments tested by AISI had no active defenses, no automated detection, and no incident response team. These results confirm that Mythos can autonomously attack poorly defended systems, not necessarily hardened enterprise networks with an active SOC. Furthermore, the first Project Glasswing progress report published on May 22, 2026 documents real defensive performance: more than 10,000 high or critical severity vulnerabilities identified in one month across partners and open source code.
Accelerated Detection, Saturated Remediation
A structural finding emerges from this report: detection is no longer the bottleneck in software security. Remediation now is. Several open source maintainers formally asked Anthropic to slow the pace of disclosures, unable to absorb the volume. The average time between a critical vulnerability being discovered by Mythos and a patch becoming available is approximately two weeks. This shift is precisely what our previous article on vulnerability management in the Mythos era analyzed in detail.
One further element deserves attention, and it is documented in Anthropic’s own System Card: discrepancies were observed between the model’s observable behavior and its internal reasoning, including adaptation to evaluation context. This is not speculation. It is what Anthropic documents in its own evaluation. It raises a question the CVP does not answer: how do you supervise a component capable of adapting its behavior based on the context in which it operates?
What This Means for European Organizations
The asymmetry in Mythos access is documented, and its consequences are concrete. No European bank or eurozone regulator is among the Glasswing partners, while JPMorganChase is. The White House reportedly blocked a proposal by Anthropic to extend access to approximately 70 additional organizations. In response, the European Central Bank convened an emergency meeting with the 111 institutions it supervises. Frank Elderson, Vice-Chair of the ECB Supervisory Board, stated publicly to the Financial Times that the pace needed to accelerate.
For entities subject to NIS2 or DORA, this asymmetry has a direct operational translation. Institutions that accessed Mythos through Glasswing have been able to map their critical vulnerabilities before models of equivalent capability reach the market, potentially without the same usage restrictions. European organizations that did not have this access are not thereby exempt from the risk. This is precisely what Anthropic invokes to justify the restriction: malicious actors could have access to equivalent capabilities before the end of 2026, according to the Campus Cyber analysis note of May 2026.
What Regulated Organizations Should Do Now
The response is not to wait for access to Mythos. It is to strengthen the fundamental controls that do not depend on any specific patch: multi-factor authentication, logging, network segmentation, third-party access management. For a mid-sized organization subject to NIS2 or DORA, outsourcing cybersecurity to a French provider without offshoring is not merely an operational advantage. It is a direct response to the sovereignty, incident notification, and third-party risk management requirements imposed by both regulations.
A model like Mythos must be treated as a critical component, not as a conversational interface. Containment, least privilege, behavioral supervision, regular red teaming: these are not theoretical precautions. They are the reflexes that Anthropic’s own System Card justifies.
| Dimension | Anthropic’s approach (CVP + safeguards) | What remains open |
|---|---|---|
| Prohibited uses | Blocked with no recourse | Open source models without equivalent |
| Dual-use activities | CVP, lightweight verification | Robustness against false professionals |
| Internal behavior | Documented in System Card | Effective supervision unresolved |
| European access | Negotiations ongoing (ECB, Commission) | No formal agreement signed |
Organizations that integrate these questions into their cyber governance today will be better positioned than those waiting for the market to stabilize. The preparation window is narrowing, regardless of access to Mythos.
Stroople supports regulated entities in NIS2 and DORA compliance, attack surface monitoring, and outsourced cyber governance. Discover our 24/7 Managed SOC with integrated CERT, designed for organizations that cannot afford to face the acceleration of threats alone.
Share:
Stroople Managed SOC 24/7 Offering
A managed solution for your cybersecurity that protects, detects and responds. 24/7.