EU outlines AI cyber plan while relying on US models

The European Commission has presented an action plan to address cybersecurity threats created by advanced AI, warning that powerful models can help malicious actors run cheaper, faster and more sophisticated attacks. EU digital chief Henna Virkkunen told lawmakers that advanced models can build cyber exploits in minutes or hours at a fraction of the cost of work done by trained humans, creating risks for infrastructure and society.

The plan focuses on recommendations, coordination and a proposed European blueprint for structured access to advanced AI capabilities. Brussels wants public authorities and private companies to gain clearer routes to test and use frontier models for cybersecurity, after European authorities and ENISA secured restricted access to Anthropic’s Mythos through Project Glasswing following lobbying efforts.

The initiative also exposes Europe’s dependence on US AI companies. Anthropic’s Mythos was cited by American security agencies as capable of identifying exploitable vulnerabilities in highly sensitive US government systems within a few hours, prompting export controls that were later lifted. The Commission says its AI Office will work with specialised evaluators under the AI Act, while some leading labs have preferred assessments by the UK AI Security Institute because it has no regulatory power.