Within the space of a few weeks, two of the world’s leading AI companies have unveiled models specifically designed for use in cyber security: Anthropic with Claude Mythos Preview as part of Project Glasswing (7 April 2026) and OpenAI with GPT-5.5-Cyber (7 May 2026). Both announcements demonstrate that AI is no longer merely a tool for text generation, but a player in its own right in the arms race between attackers and defenders of digital infrastructure. For organisations falling under the NIS2 Implementation Act or preparing for the Cyber Resilience Act, this has significant practical and legal implications.
According to Anthropic, Claude Mythos Preview is the company’s most powerful model to date – and also the first not to have been released for general use. Anthropic explicitly cites the dual-use risk as the reason for its restrictive release strategy: the model is capable of autonomously detecting security vulnerabilities and – in the wrong context – exploiting them. Anthropic is reported to have communicated internally to US government agencies that an uncontrolled release would make large-scale AI-assisted cyberattacks in 2026 “significantly more likely”.
With GPT-5.5-Cyber, OpenAI is pursuing a complementary but conceptually different strategy. The model is not a fundamentally new architecture, but rather a variant of GPT-5.5 – released in early April 2026 – tailored to cybersecurity tasks. It has been specifically trained for less restrictive security workflows – such as vulnerability identification, malware analysis and patch validation – and is accessible to verified users via the ‘Trusted Access for Cyber’ (TAC) programme. Unlike Mythos Preview, GPT-5.5-Cyber is explicitly not aimed at enhancing offensive capabilities, but rather at reducing unnecessary friction for legitimate defensive tasks.
Project Glasswing is more than just a technical pilot project. The consortium, which includes AWS, Apple, Cisco, CrowdStrike, Google, JPMorgan Chase, Microsoft, NVIDIA and Palo Alto Networks, is granted exclusive access to Claude Mythos Preview – coupled with up to US$100 million in model credits and US$4 million for open-source security organisations. Just one month after launch, Anthropic reported that the model had identified more than 23,000 potential vulnerabilities in critical software, including over 1,700 validated genuine security vulnerabilities of high or critical severity across more than 1,000 open-source projects.
This speed illustrates the fundamental problem: with AI support, security vulnerabilities can be found faster than they can be patched. Less than one per cent of the vulnerabilities identified by Mythos had already been fixed at the time of reporting. The implication for businesses is immediate: those who have relied on reactive security strategies to date will be at a structural disadvantage in an AI-driven threat landscape.
For organisations falling within the scope of the NIS2 Directive – and which, since its transposition into German law via the NIS2 Implementation Act (NIS2UmsuCG), are directly affected – developments surrounding Claude Mythos and GPT-5.5-Cyber are of immediate legal relevance.
Under Section 30 of the new BSIG, essential and important organisations are obliged to take appropriate technical, operational and organisational measures to manage cyber risks to their network and information systems. This obligation to manage risk is dynamic and must reflect the state of the art. If AI-enabled autonomous attack vectors become the new norm, the benchmark for what constitutes an ‘appropriate measure’ will automatically shift.
In concrete terms, this means that organisations must promptly review their risk assessments to ensure they adequately account for the scenario of AI-enabled attacks on their systems. Vulnerability management processes, penetration tests and security monitoring must be aligned with a threat model in which the attacker no longer acts manually, but instead employs autonomous models that identify vulnerabilities in critical infrastructure on a large scale and at high speed.
At the same time, the Cyber Resilience Act (CRA), which has been in force since March 2024 and whose technical requirements are being phased in, imposes increased requirements on manufacturers of products containing digital elements. The obligation to carry out continuous monitoring and patch management under Article 13 of the CRA takes on a new sense of urgency in an environment where AI models can significantly increase the detection rate of zero-day vulnerabilities.
The classification of models such as Claude Mythos Preview as ‘dual-use’ technology is legally significant. It raises questions regarding liability in the event of misuse, even within authorised consortium structures. The access restrictions imposed by Anthropic and OpenAI are clearly designed as compliance mechanisms: they are intended to ensure that only vetted users gain access to capabilities that could take on an offensive nature if used in the wrong context.
For companies that use or purchase such models internally, this results in an extended duty of care. Where AI tools with enhanced cyber capabilities are used within a company, it must be ensured that access is controlled, documented and restricted to authorised purposes. In the event of a breach – such as unauthorised use by the company’s own staff for malicious purposes – civil and criminal liability risks may arise that go beyond general IT compliance.
It is worth noting that the UK’s AI Safety Institute (AISI) evaluated GPT-5.5 even before its public release and published the results. The organisation concludes that, in standardised cybersecurity benchmarks, GPT-5.5 achieves a level of performance comparable to that of other frontier models. Basic tasks – such as reconstructing attack chains from packet captures or reverse engineering small binary files – have been fully solvable by current models since at least February 2026.
From a regulatory perspective, this is an important signal: official evaluations of AI models from a cybersecurity perspective are becoming an established testing standard. Organisations should expect that national authorities – the BSI, the BfDI and the relevant supervisory authorities under NIS2 – will, in future, pay increasing attention to how organisations deal with AI-enabled threats and what measures they have taken to manage these risks.
The launch of Claude Mythos Preview and GPT-5.5-Cyber marks a qualitative shift in the cybersecurity landscape. For regulated companies and KRITIS operators, this is not merely technical background noise, but a concrete reason to review and adapt their security management.
Organisations should first review their existing risk assessments and threat models to determine whether autonomous AI attack vectors are recognised as a distinct threat category. On this basis, they must assess whether their existing technical and organisational safeguards still comply with the current state of the art as defined in Section 30 of the new BSIG. Vulnerability management deserves particular attention here: if AI models identify vulnerabilities more quickly than traditional scanning methods, the organisation’s own patching process must be accelerated and prioritised accordingly. Finally, organisations that use or plan to use AI-powered security tools should establish clear internal governance structures that ensure access control, logging and purpose limitation – not only for regulatory reasons, but also to limit their own liability risks.
Subscribe to our GvW Newsletter here - and we will keep you informed about the latest legal developments!
