AI models now weaponize cyber attacks at scale

What happened

VivaTech, Europe's largest startup conference, drew 180,000 attendees in Paris and surfaced three urgent concerns: advanced AI models like Anthropic's Mythos and OpenAI's GPT-5.5 Cyber can now find vulnerabilities and generate working exploits at speed and scale; Europe faces a deepening dependence on U.S.-controlled AI infrastructure after the U.S. cut off access to Anthropic's frontier models; and enterprise customers are shifting from chasing AI hype to demanding concrete business cases and return on investment.

Why it matters

The window where defenders have better AI tools than attackers may close quickly, creating a security gap as criminal groups and nation-state actors gain access before organizations can patch systems. Europe's vulnerability to U.S. policy decisions (exemplified by the sudden Anthropic cutoff) has made AI sovereignty—control over chips, data centers, and deployment—a pressing political priority for governments and companies. For businesses, the shift toward ROI scrutiny means AI budgets will be evaluated on whether they deliver measurable value, not just technological capability.

What to watch

OpenAI expanded its Daybreak initiative by pairing GPT-5.5 Cyber with an open-source patching effort called Patch the Planet, working with firms including Cloudflare, Cisco, and CrowdStrike to help organizations find and fix vulnerabilities. Anthropic and OpenAI have both staggered releases of their advanced cyber models to give defenders initial access before broader availability. The debate over sovereignty revealed diverging views: some executives like Cohere's CEO call for domestically controlled infrastructure, while Amazon's Peter DeSantis argues that fully sovereign infrastructure is unrealistic and a pragmatic approach focusing on data residency and governance is more practical.