BNP Paribas works with Mistral on a European answer to Anthropic’s Mythos

BNP Paribas is working with Mistral AI to prepare for a category of AI cybersecurity tools its US peers already use and its European supervisors cannot reliably get hold of, according to a Bloomberg report on Tuesday.

The Paris-based bank, the eurozone’s largest by assets, is one of several European institutions helping Mistral develop a cyber-focused model intended as a counterpart to Anthropic’s Mythos.

Mythos is the restricted-access AI system Anthropic launched earlier this year that can identify and exploit security vulnerabilities at machine speed; in controlled testing the model produced working exploits on its first attempt more than 83% of the time, often beating human red-teamers.

Access has been deliberately rationed to roughly 40 to 50 organisations, mostly large US tech firms, US national-security partners and a handful of US banks including JPMorgan Chase. No European bank sits on the list. The European Commission has been in stalled talks with Anthropic over access since April, with Spanish officials publicly describing the negotiations as deadlocked.

The European Central Bank has spent the past several weeks warning eurozone supervisors that Mythos-class tools change the threat picture for banks regardless of who has access. If attackers obtain a comparable model, the ECB’s Frank Elderson told banks earlier this month, defenders without one will be structurally behind.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!

The Bundesbank has formally backed Brussels in pressing Anthropic for access. Anthropic has so far resisted on the grounds that wider distribution would make the model itself a weapon.

That standoff is the gap Mistral is trying to fill. The French firm, already Europe’s best-funded foundation-model company, has been pitching a sovereign European alternative since at least mid-May. BNP Paribas’s involvement is the most concrete sign yet that the European banking sector is willing to put balance-sheet weight behind the project rather than wait for Brussels-Anthropic talks to unblock.

The two firms already have a three-year commercial agreement across Mistral’s broader model lineup, signed in February.

What the Mistral cyber model would actually do is, on current public reporting, an answer that has not been independently demonstrated. Mythos is a particular kind of system, trained to combine vulnerability discovery with exploit generation in a single workflow, and replicating that capability without the access to red-team data Anthropic has accumulated will not be straightforward.

The pitch to BNP Paribas and other prospective European bank customers is in part that a sovereign model with even somewhat lower capability is preferable to no model at all on the defensive side. It is also a hedge against the possibility that Brussels-Anthropic talks collapse permanently.

The broader pattern here is familiar from the past year of European tech policy: a US firm builds a frontier capability, restricts access on safety or national-security grounds, and European institutions respond by trying to build a domestic equivalent.

The same logic has driven recent European pushes on cloud sovereignty, payments rails and, most loudly, semiconductor manufacturing. Banking cyber-AI is the newest entry in that list, and the BNP Paribas-Mistral pairing is its highest-profile concrete project.

Neither BNP Paribas nor Mistral commented on the specific Bloomberg report. Mythos has not been demonstrated in the wild on a European bank to date.