Anthropic’s restricted access to its Mythos model raises a wider question: who gets the tools to find and fix vulnerabilities when advanced AI can help do both? In a Just Security essay published on 15 October, Bulelani Jili argues that the arrangement could make access to defensive capability a new source of digital dependence.
Anthropic Watch analysis
What happened
Jili’s essay says Anthropic restricted Mythos to trusted-access programmes because of its cybersecurity capabilities, and describes Project Glasswing as giving selected organisations early access for defensive work. The essay also says access was suspended while US export controls were in place, until the controls were lifted.
The argument is not that controlled access is inherently wrong. A defensive head start could give organisations time to find and patch flaws before similar capabilities become more widely available. Jili’s concern is that the public account offers limited transparency about who qualifies and how access is prioritised.
Why it matters
Governments can own or host local infrastructure and still depend on outside firms for the models, updates and expertise needed to secure it. If a small group of companies controls access to powerful cybersecurity AI, that can shape which institutions get time to prepare and which remain reliant on others.
That is a concrete tension in the AI security debate: reducing the risk of harmful capabilities spreading may also concentrate defensive advantages. The essay argues the problem is especially sharp for institutions with fewer resources to develop comparable tools themselves.
Our read
Jili makes a useful case that “who gets access?” is not just a product-policy question when the product can help uncover security flaws. But the essay’s concern about unequal preparedness is a warning about possible consequences, not evidence that particular organisations have been left exposed. The case for restrictions and the case for transparency both deserve to be taken seriously; neither gets to wave away the other with a security-shaped shrug.
What to watch
- Whether Anthropic explains how organisations are selected for Project Glasswing.
- Whether the initiative reports what vulnerabilities it helps identify and remediate.
- How governments and institutions outside the programme build their own defensive capacity.
Discussion spark: Should frontier AI labs publish clear access criteria for defensive cybersecurity tools, even when wider transparency could increase security risks?
Sources and evidence
- The Mythos of Digital Sovereignty (15 October 2026, 13:05 UTC)
Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.