The first thing I noticed when I gave up American technology was the silence.

My phone usually starts up before I get out of bed, buzzing every few minutes throughout the day with calls, messages, headlines, calendar reminders and social media alerts. It’s a constant pulse that averages nearly 200 iPhone notifications on weekends and twice as many Monday-to-Friday.

But on this warm mid-summer Sunday, my life was on an unlikely version of mute. After years of reporting on Europe’s push to wean itself off U.S. tech giants and cultivate homegrown alternatives, I had decided to test my own daily habit by cutting myself off from using any American technology for 72 hours.

No iPhone. No Mac. No Slack or Teams. No Google Search or Maps. No ChatGPT. No WhatsApp or Signal. No Facebook or Instagram feeds. No credit card payments.

I wondered if I would turn into a digital monk.

For three days, I set out to live and work in Brussels as if U.S. tech had suddenly become unavailable to me overnight. It was a purposefully fictional scenario rooted in a very real European anxiety: what happens if Washington weaponizes our continent’s Silicon Valley dependence and reaches for the tech “kill switch?”

Limited versions of that scenario have already surfaced. When U.S. President Donald Trump’s administration cut off French-born International Criminal Court judge Nicolas Guillou from U.S.-linked financial and technology services, he called it a form of “civil death.”

Meanwhile, U.S. export controls in June forced Anthropic to block foreign nationals from accessing two of its most advanced AI models, offering a glimpse of what government bans on access to cutting-edge technology can look like.

Such episodes feed into mounting fears that the Trump administration could use Europe’s overreliance on U.S. tech as leverage in trade fights or disputes over EU regulations. A Proton survey released earlier this month found that 74 percent of European business leaders worry such a cutoff could disrupt their operations.

In my own little experiment, the stakes were much lower. Yet I was about to find out that replacing American tools with those built here in Europe was going to make almost everything harder — and lonelier.

Trying to live without U.S. tech, I would find out, essentially amounts to trying to live without tech at all. That was partly because, like virtually all of my fellow Europeans, I had locked myself into those consumer choices.

Dumbphones and FOMO

The early symptoms of going cold turkey looked suspiciously like withdrawal.

On that first morning, with my iPhone shut off, I reached for a Nokia brick from Finland. The so-called dumbphone is the type of device now enjoying a second life among people detoxing from screen time and is also a favorite of drug dealers seeking to avoid getting busted by any tracking and data collection.

Several hours in, I realized there were no notifications on the Nokia. Nobody calls or texts anymore. Then came the shameful part: a sense of helplessness, followed by FOMO-fueled restlessness. The world had surely kept spinning at full speed, and I was missing it. For the next few days, I would still catch myself checking the phone compulsively like an addict.

“The phone aged you instantly,” my best friend joked later that day as we traded our now-standard FaceTime video calls for a regular one. It was unclear whether he meant the muffled audio or me struggling with a new-but-actually-old device, or both.

I did notice that I was pacing up and down my flat because my usually overstimulated brain apparently couldn’t handle focusing on a voice-only call.

One instant benefit from my dumbphone: no doomscrolling in bed.

It all took me back to my first cellphone at 13, when texting meant tapping the same tiny key several times for a single letter, every SMS cost money and abbreviations and emojis were not just stylistic choices but ways to squeeze more into a message.

I knew my social media life would be at risk in my experiment. European alternatives such as Mastodon have gained traction since Elon Musk turned Twitter into X. But who joins a social network when none of their friends are there?

That was fine. I was actually eager to disappear for a while, well aware of the anxiety social media induces in me and the insecurities created by constantly watching other people’s supposedly perfect lives.

Online shopping was out — but so too was paying by card in stores and restaurants. The payment networks I rely on are American: Visa and Mastercard dominate card payments across Europe, meaning that even a purchase made with a European bank card often still runs over U.S.-controlled rails.

It meant I had to buy everything using cash, which I hadn’t done regularly in ages. Fortunately, unlike in some other European countries, Belgian legislation requires merchants to accept banknotes. The hard part was finding some of those stores without the help of Google Maps, which I’d come to rely on almost as much as my credit cards.

The invisible grip

Swearing off Netflix, Amazon Prime, Disney+ and YouTube was also part of the deal — already eliminating a sizable chunk of my leisure time. But it turned out I could barely watch anything at all, or even properly test European streaming platforms, because my television and tablet both ran on Google software.

Thankfully, an offline Nintendo Switch from Japan, good old books and the legendary Snake game kept me company.

These invisible dependencies run deep. Beyond the products we use every day, U.S. systems often serve as gateways to European companies trying to take on Big Tech.

Take Sweden’s Spotify or the Estonia-based rival to Uber, Bolt. Both still heavily rely on U.S.-controlled app stores, operating systems, payment networks and other digital infrastructure.

And then there is the cloud: the data centers and servers that host websites, process data and route traffic. The vast majority of that market is dominated by Amazon, Microsoft and Google, whose infrastructure supports large parts of Europe’s digital economy.

Many corners of Europe would go dark if those services were shut down, with its economy, public administration and communications infrastructure struggling to function normally.

Working outside the stack

On Monday morning, I walked into the office with the slightly misplaced confidence that I had prepared for everything. My efficiency at work, admittedly during a very quiet summer week, took less of a hit than I expected.

I was still working from the office. I used an open-source, Linux-powered computer. I communicated by email through a Switzerland-based Proton address, browsed the web using the Norwegian browser Vivaldi and French search engine Qwant, wrote everything in LibreOffice and even tried Mistral’s generative AI assistant. And there was always a good old notebook.

I felt productive. But the workflow around me was not. The tools themselves worked perfectly well once I accepted that breaking years of habits would take time. The disruption ultimately came from stunted collaboration: meetings, messages, shared documents and the constant stream of small exchanges that keep a newsroom moving.

“It was like you disappeared,” one colleague would tell me later.

European alternatives do exist in that space. The problem is, just like for social media, they only work properly when everyone else uses them too or when competing systems are interoperable — something the EU has long tried to legislate and enforce, often against resistance from large technology platforms.

For this little while, despite technically being able to continue working, I became an outsider within my own team. I had to skip our routine video meetings on Slack and Teams, while missing messages sent over WhatsApp and Signal.

In a trade, a city and an era built around instant messaging, sending a good old SMS felt almost prehistoric — a reminder of the longstanding complaints from the European telecom industry about losing messaging and calling revenues to U.S. tech firms.

Ultimately, this underscored one of the major pinch points in Europe’s push for greater tech independence: digital sovereignty is not an individual project. It only works if people, companies and institutions move together.

On their own, individual efforts are more likely to leave people feeling digitally isolated rather than digitally sovereign.

Relax and relapse

And yet, there was something blissful about these three days.

The initial anxiety slowly gave way to a kind of peace. Of course, that feeling may only reflect that the experiment was temporary and my digital life had not been erased.

The experience nevertheless highlighted how much I had taken these tools for granted. I have placed all my eggs in the same digital basket: my communication channels, the tools I use to authenticate myself and access the digital world, my polished digital self and years of accumulated knowledge, all stored inside one sprawling digital safe.

The concern is no longer simply whether that safe could be broken into from the outside. It is also whether somebody could lock it — or empty it — from within.

Now, as you might wonder how I’ll act on what I’ve learned, I am strangely reminded of Covid.

Many of us emerged from that temporary era of lockdowns and involuntary limits full of healthy new habits and grand ideas about how our lifestyles should change, only to return remarkably quickly to our old routines.

Sadly, the same thing happened here. My iPhone came straight back into my pocket. Messages began flowing through again. My bank card returned to its usual place. Within hours, I had fallen comfortably back into the U.S. technology stack.

As I switched my smartphone back on, my screen lit up with incoming texts inquiring whether my little experiment was over. After 72 hours of old-school SMS exchanges, two different friends were both clearly eager to return to reality, sending me the same final text: “Back to WhatsApp?”

The Trump administration has granted preliminary approval for a cryptocurrency venture backed by President Donald Trump’s family to operate a federally chartered trust bank, over the protests of Democrats who decried the decision as riddled with conflicts of interest.

The Office of the Comptroller of the Currency, the bank regulatory arm of the Treasury Department, said in a letter on Friday that it was conditionally approving World Liberty Trust Co.’s application for a trust bank charter. The company must still meet additional requirements before it receives final approval, the regulator said.

The decision stands to give new powers and federal credibility to a venture in which Trump and his family retain a substantial financial interest. It’s also among the most direct official actions that the administration has taken involving the president’s private finances.

World Liberty Trust Co. President and Chairman Zach Witkoff said the charter will allow the company to manage its USD1 stablecoin, a crypto token whose value is pegged to $1, under the OCC’s watch.

“USD1 grew because institutions trust how it operates, and confidence at enterprise scale deserves the backing of federal supervision,” Witkoff, the son of Trump’s special envoy, Steve Witkoff, said in a statement. “We welcome continuous scrutiny from Federal regulators for many years to come.”

While Washington has been in knots over the steady drumbeat of news that Trump-linked businesses are expanding during his second term, the World Liberty application stood out to many.

Some Democrats and ethics watchdogs argued that the bid was one of the clearest examples of the conflicts of interest that administration officials face as they weigh the wishes of Trump family-backed companies. And they were quick to bash the OCC’s approval.

“This is the most brazen act of self-dealing our financial system has ever seen — and Congress cannot allow it to stand,” said Sen. Elizabeth Warren, the top Democrat on the Senate Banking Committee.

Warren and other Democrats unveiled legislation on Friday that would prohibit regulators from approving banks that are owned or controlled by the president or the president’s family, vice president, members of Congress or other top government officials.

A Democratic Senate aide said the Banking Committee would likely probe the OCC’s approval of the World Liberty bank charter next year if Democrats regain control of Congress.

Citizens for Responsibility and Ethics in Washington CEO Donald Sherman called the OCC’s approval “the most egregious example to date of the President’s businesses profiting from his government job.”

“The President continues to boost the crypto market at the expense of everyday Americans who are wondering what happened to the money in their own bank accounts,” he said.

World Liberty, in advance of the approval, had rejected the conflict allegations — saying Trump is not involved in managing the company and that none of its leaders or employees work for the federal government. The White House has similarly said Trump has no involvement in business deals that would implicate his official responsibilities.

Trump and his family nevertheless retain a substantial financial stake in World Liberty Financial. DT Marks DEFI LLC, an entity affiliated with Trump and members of his family, owns about 38 percent of the holding company that controls World Liberty Financial, according to the company’s website. The entity and Trump family members also hold 22.5 billion of World Liberty’s governance tokens.

Trump disclosed nearly $600 million in income from World Liberty token and equity sales in 2025, a major piece of the $1.4 billion of crypto-related earnings he raked in. He has said he does not manage his financial interests, which are overseen by his children.

The approval doesn’t allow World Liberty to open a traditional bank, but rather a national trust bank — a limited-purpose institution that would not make loans or accept federally insured deposits. It’s the latest in a string of such approvals for crypto firms under Trump’s OCC. Others who have received similar green lights include Circle, Ripple and Coinbase.

The charter still provides significant legal and financial advantages. It’ll allow World Liberty to issue and redeem its USD1 stablecoin directly, manage the reserves backing it and offer digital asset custody services without relying on an intermediary. The company could also operate across state lines more easily without having to answer to individual state regulators.

Federal supervision could also bolster World Liberty’s credibility with customers and investors and help expand the use of USD1.

“This is not World Liberty trying to become Chase or Bank of America. This is World Liberty trying to become like Circle,” the crypto giant, said Austin Campbell, a crypto adviser and professor at New York University. The newly acquired charter, Campbell added, “is a regulatory wrapper to be able to hold these things in the way required under U.S. law to do business with both retail and the big boys.”

The decision to approve World Liberty Trust Co. had put Comptroller Jonathan Gould, a Trump appointee, in the extraordinary position of deciding whether to grant federal banking privileges to a business tied to the president’s family.

Gould had rejected calls to pause the review or recuse himself. And he declined a request by Democrats to share the full, unredacted application submitted by World Liberty. “We process applications in a fair and evenhanded manner,” he told lawmakers in February.

Stephen Lybarger, the top OCC official overseeing bank chartering and a longtime career official of the agency, wrote in the approval letter on Friday that the agency followed “established policies and procedures” in evaluating World Liberty’s application.

“The Comptroller and staff acted consistently with their statutory duties and ethical obligations with respect to the Application,” Lybarger wrote. “Career OCC staff reviewed the application for consistency with the statutory, regulatory, and policy requirements and factors for approval of a de novo application.”

The OCC declined to comment further. The agency consulted with career government ethics officials as it evaluated the World Liberty application, according to a person familiar with the process.

President Donald Trump is paving a legal pathway for U.S. companies to launch cyberattacks on foreign cybercriminal gangs — a significant and potentially controversial measure that would put approved tech and cybersecurity firms on the front lines of digital combat.

The presidential memorandum, released late Wednesday, comes as the Trump administration has repeatedly pushed for more aggressive action to counter foreign scams and cyberattacks, which the White House said cost Americans nearly $21 billion last year.

The memo represents one of the biggest shifts in U.S. cyber policy undertaken in recent years. It would empower tech and security companies — whose data and control over internet infrastructure often offer unique insight into foreign hacking operations — to mount state-sanctioned digital strikes.

While many such companies already work closely with U.S. intelligence and law enforcement agencies, a web of legal and political constraints has long prevented them from taking direct action inside foreign networks.

Companies that want to participate would be required to sign contracts with both the Department of Justice and the Department of Homeland Security and to undergo what the memo describes as “rigorous vetting” while working with the government. The overall effort would be overseen by a National Coordination Center, established in an earlier Trump administration executive order, with co-executive directors from DOJ and DHS.

However, the memo states that no operations by the companies would be approved until the executive directors at DOJ and DHS establish “consensus procedures” with the White House Homeland Security Council guaranteeing “complete oversight and control of Participating Companies’ performance.”

Those procedures, it notes, should be drafted within 60 days. They are likely to be extensive.

They will outline steps for participating companies to obtain approval for proposed offensive hacking operations, so the government can confirm that the targets are criminal gangs and ensure that operations are consistent with U.S. law and don’t undermine ongoing U.S. intelligence efforts. Companies could propose surveillance operations to help identify criminals or “effects” operations to degrade the systems they use to stage their attacks.

Participating companies would have to pass minimum standards for technical expertise and personnel vetting, and would be required to notify the federal government if they believe approved operations may result in the loss of life or rise to the level of use of force under international law.

Some see the memo as a critical step to help the U.S. government counter foreign cybercriminal gangs that operate outside the reach of U.S. law enforcement.

“For years we’ve called the American technology industry a strategic asset but left it on the cyber sidelines,” Joe Lin, the CEO and co-founder of Twenty, a start-up that builds offensive cyber tools for the U.S. government, said in a statement. “This administration is changing the paradigm.”

The memo notes that companies will only be authorized to target criminals that are “not an institutional part of a foreign government or wholly operated under a foreign government’s direction.”

Even with the help of the U.S. intelligence community, making that distinction could be difficult.

Adversaries such as Russia, China and Iran have persistently targeted U.S. critical infrastructure, including water systems, ports, and telecommunications infrastructure, while multinational crime syndicates have defrauded billions of dollars annually from Americans via complex online schemes.

But many cyber gangs in Eastern Europe are thought to operate with the tacit consent of the Russian government, while state hackers in Iran and China sometimes moonlight as cybercriminals to earn extra money or deflect blame for their governments’ attacks.

More broadly, it is not always easy for digital investigators to determine who is responsible for a given cyberattack, or who different computer networks belong to — another risk the memo contemplates.

Companies that accidentally carry out operations targeting a U.S. citizen or network will be required to immediately pause the operation and notify the U.S. government, the memo states. It does not appear to preclude activities that are deliberately “directed” at a U.S. person, so long as they receive “any necessary authorization, judicial or otherwise, prior to approval of the operation.” Under U.S. law, a “U.S. person” can refer to an American business or organization.

Many lawmakers and security experts have broadly supported calls for the private sector to play a larger role in responding to cybercrime, though not all approve of granting them the ability to launch active hacking efforts.

In recent years, some House members have debated the idea of issuing “letters of marque” to private companies to carry out cyberattacks on behalf of the U.S. government, similar to the U.S. Navy authorizing private ships to disrupt British shipping during the War of 1812.

As part of a more assertive cyber posture, Trump has turned to U.S. Cyber Command to mount digital attacks in tandem with U.S. military operations, including in Iranand Venezuela. He signed an executive order this March to clamp down on countries that fail to take action against scam centers operating within their borders.

That same month, the White House called on the private sector to broadly help it “disrupt” foreign adversaries in its new national cyber strategy, though it stopped short of telling private companies to take riskier and more consequential steps, such as directly launching attacks against foreign criminals.

Some of the most prolific online fraud operations are believed to emanate from scam compounds in Southeast Asia. But hackers from North Korea — who for years have stolen hundreds of millions in cryptocurrency from victims around the world — would likely be exempt from targeting by U.S. companies since they work at the direction of the North Korean government.

Polish Foreign Minister Radosław Sikorski on Wednesday threatened to reconsider Warsaw’s $50 million-a-year spending on Elon Musk’s Starlink network, joining a growing government backlash over new roaming restrictions set to hit Polish customers later this month.

“Hey, @elonmusk, big man, stop discriminating Polish users of Starlink or we might re-think paying you $50 million p.a. for your services,” wrote Sikorski on X.

The foreign minister’s anger follows Starlink’s decision to exclude Poland from a shared European roaming zone that covers more than 30 countries, including Germany, Czechia, Slovakia and Lithuania. Customers within the zone can take their terminals across borders without triggering international-use restrictions. But Polish users will now face extra requirements when traveling.

“Note: Poland is not included in the Europe region above. Accounts registered in Poland are treated as Poland-only for home-country use,” reads Starlink’s current guidance.

Polish Digital Affairs Minister Krzysztof Gawkowski also went after Musk, accusing Starlink’s parent company SpaceX of treating Poles as second-class customers and demanding it spell out the regulatory basis for the change.

“Poland is not a second-tier market. Polish customers are not second-tier customers,” Gawkowski wrote on X. If SpaceX blames “local regulatory requirements,” Warsaw expects it to point to the specific rules rather than offer “general explanations,” he added.

The new rules have applied to new customers signing up for Starlink since July 14, 2026 and will extend to existing Polish users on Aug. 17.

This isn’t the first time Sikorski and Musk have fought over Starlink. Last year, Musk told the Polish minister to “be quiet, small man,” after Sikorski warned that Warsaw could seek alternative providers for the satellite service it’s financing for Ukraine.

SpaceX did not immediately respond to POLITICO’s request for comment.

A Berlin-based non-profit has filed a criminal complaint against Meta’s smart glasses, arguing the devices breach Germany’s strict privacy rules and should be banned.

Privacy concerns over the device have snowballed in recent months amid reports of people being filmed without their consent, or recording intimate footage without knowing it could be reviewed by Meta contractors.

The non-profit HateAid is arguing that the sale of Meta smart glasses in Germany is a criminal offense because the devices allow wearers to covertly film other people.

The complaint, which alleges the sale breaches Germany’s Telecommunications, Digital Services and Data Protection Act, was filed against Meta, Ray-Ban and Oakley — eyewear brands that have partnered with Meta to design the glasses — and several retailers.

Meta spokesperson Matthew Pollard said the smart glasses were approved by Germany’s regulator BNetzA in 2022, and “were built with privacy safeguards from the ground up that go beyond what any smartphone offers.” Those include an LED light that turns on when the glasses are recording, as well as technology to stop anyone from tampering with the light.

HateAid said that smart glasses should only be sold if they are clearly identifiable, and that there should be limits on recording in certain spaces as there is for dashcams or bodycams.

Europe’s privacy regulators have commissioned a report on smart glasses that is due to be finalized this summer.

BRUSSELS — The EU’s new biometric border-check system is causing such long delays for summer travelers that some airports are turning to a simple solution: switching it off when they’re overwhelmed by arriving travelers.

The quick fix, which is allowed under EU regulations, wasn’t what was envisioned when the Entry/Exit System was gradually introduced in October and went fully into force on April 10.

And yet, many airports are doing just that.

“When lines form during the busy summer months, the system is shut off to ensure smooth transit at our hubs in Paris and Amsterdam,” Air France-KLM told POLITICO. 

Airline CEOs, border authorities, and airport officials said biometric checks are suspended when border crossings become congested at other hubs, including in Frankfurt, Brussels and Milan.

The EES applies to non-EU citizens entering the 29-country Schengen zone. Instead of heading to a border agent to get passports stamped, passengers have to use an EES kiosk to provide their fingerprints and be photographed — which will be kept on file for three years — but if those aren’t working then the information has to be taken manually.

They then head either to electronic passport gates or to border agents to enter. The goal is to keep track of visa overstays.

“The advantages of the new system for the EU are evident,” said Guillaume Mercier, a Commission spokesperson. “It increases the security of EU citizens and replaces paper stamping with a modern system of registration and checks.”

The Commission said earlier this year that biometric checks allowed authorities to detect identity frauds that would otherwise “likely have gone undetected.”

Many airports, ports, road border crossings and rail terminals have adapted to the new demands, but tourist-heavy locations have seen hours-long waits.

“Connecting flights were missed due to the EU entry system,” Lufthansa CEO Carsten Spohr said on Tuesday.

Under pressure from the travel industry, the Commission granted a waiver for the peak summer season lasting until Sept. 6. The EES regulation “includes the possibility to temporarily suspend the registration of biometrics in case of exceptional circumstances during the summer,” said Mercier.

“We’ve been able to achieve this with German authorities and with Frankfurt Airport because delays were getting too long,” Spohr told reporters. 

This exception applies to all entry points, not just airports.

A British traveler, Rene Colandog, said on Friday he only had to present his passport before boarding a Eurostar train at London St. Pancras last month. Facial scans and fingerprints were not required. 

“I’m OK with this biometric system … as long as it’s for security,” Colandog said before boarding the train from Brussels back to London. 

Teething troubles

The EES was adopted in 2017, but it was delayed for years because border authorities were not ready to handle the additional workload. 

Even now, getting travelers properly registered in the new system still requires significant staffing. Another problem is that the EES is still new, so almost all travelers are registering for the first time — creating additional delays.

“At Milan Malpensa Airport, border control teams currently consist of about 35 people,” said Cristian Sternativo, a border control officer at the Italian airport and local representative of Italy’s Autonomous Police Union. 

To carry out all the checks required by the EES without creating long lines, “at least 10 to 15 more people would be needed during the busiest times,” he added.  

It is “unthinkable” to expect the EES to operate at full capacity with the current level of staffing because the new system “requires more time,” he said.

Even at Brussels Airport — barely 10 kilometers from the EU institutions — the technology is still not fully operational; biometric data collection suspensions started well before the summer under a derogation issued in late March after 600 passengers missed their flights over just 21 hours.

“The Federal Police Border Control may decide to apply this derogation when necessary,” Belgium’s police confirmed this week.

Now, eight EU countries and Switzerland want the summer derogations extended beyond Sept. 6. 

A strict application of the full procedure “would lead to public order issues” because “there are certain peak periods when the current infrastructure isn’t sufficient to accommodate everyone,” Sternativo said.

Security vs. speed

Despite suspending biometric checks, border authorities insist that security isn’t undermined.

“The traveler is always registered in the EES and the required travel document data are entered into the system,” the Belgian federal police said in a written reply, adding that “the security of border checks and compliance with European regulations remain our absolute priority.”

Passenger experiences vary depending on where they enter the EU.

Kathleen Glass, who regularly travels from the U.K. to the EU, waited only about 15 minutes to complete biometric checks at London St. Pancras on Friday morning before boarding a Eurostar train to Brussels.

William, from Edinburgh, who asked not to have his surname published, said biometric checks at a German airport during Christmas took between 40 and 50 minutes.

The ability to suspend biometric collection appears to be keeping the system functioning this summer.

“Although we are early into the summer season, we are not receiving reports of excessive queues,” said Luke Petherbridge, director of public affairs for the Association of British Travel Agents.

The stress over the EES is only a precursor to the next border technology change being planned by Brussels. The bloc’s next goal is the online European Travel Information and Authorization System, which will require travelers from 59 visa-exempt countries to preregister, undergo a security check and pay a small fee before entering Schengen.

ETIAS — similar to systems already in use in the U.K., and the U.S. — was originally supposed to launch in 2021, and then later this year, but is now delayed until 2027.

Leading artificial intelligence models from Anthropic and OpenAI created fake online personas and tried to deceive human coders into abetting a cyberattack during a recent safety evaluation, the U.K.’s AI Safety and Security Institute disclosed Tuesday.

It marks the latest case in which a powerful AI system has attempted a digital attack on an unwitting third party without direct prompting during such an evaluation — heightening concerns the powerful technology is advancing too fast for responsible oversight.

The disclosure is likely to ignite fresh calls in Washington and Silicon Valley for more rigorous regulation of the AI industry, particularly over frontier models with advanced capabilities to detect and launch cyberattacks. It comes just days after similar testing mishaps involving some of the same models from OpenAI and Anthropic sparked urgent calls for new AI safety regulation and a push within Silicon Valley to slow the rapid pace of AI development.

Like its U.S. counterpart, AISI routinely conducts security evaluations to better understand what dangers both new and soon-to-be-released AI models pose to public health and safety. But even the digital security body said the actions it uncovered by Anthropic’s Claude Mythos 5 and ChatGPT 5.6 — the latest publicly released model from either AI lab — were unlike anything it had seen before.

“This is the first time AISI has seen deception of this severity that was targeted at a real person, unprompted, in the real world,” AISI said in a 35-page technical report accompanying a blog post Tuesday.

AISI said the malicious activity began on July 25. The AI safety evaluator detected it and launched an investigation on July 28, when it spotted “unusual data transfers” stemming from a cyber evaluation it was conducting on Mythos 5 and ChatGPT 5.6.

Overall, AISI determined that Mythos 5 and ChatGPT 5.6 took “autonomous, unsanctioned action on the live internet, targeting real people and organizations” during 10 of the 122 evaluations the research body conducted and isolated for review. The majority of those actions, it said, involved Mythos 5 and arose during a “single, sustained line of activity.”

In the most alarming incident it uncovered, Mythos 5 attempted a supply chain attack — a sophisticated technique often deployed by North Korean and Russian cyber operatives, in which hackers bury malware inside legitimate code.

To do so, Anthropic’s model created “multiple fake identities” on developer platform GitHub and used them to send messages “pressuring” an open-source software engineer to unwittingly introduce a bugged update into code widely available on the popular site, AISI said. When that effort failed, the AI “edited its earlier activity to appear harmless” and “considered adopting a fresh identity to continue,” AISI added, a sign the model was intent on repeating the ruse.

As part of the same effort, Mythos 5 also sent direct messages over GitHub to software engineers that contained malware.

In another sign of deceitful behavior AISI uncovered in its investigation, multiple AI agents it was testing appeared to communicate with one another about how to convince real engineers using GitHub to trust them. “One agent left public messages on GitHub offering collaboration with other agents working on the same challenge,” AISI wrote.

AISI’s blog and technical assessment make no mention of whether the models also attempted to exploit previously unknown software bugs — called zero-days — during the evaluation.

Last month, OpenAI disclosed that GPT 5.6 and another of its models escaped onto the open internet during what was supposed to be a controlled test, and then hacked another company in a first-of-its-kind, autonomous breach.

In response, Anthropic launched an investigation into whether any of its models took illicit action during recent testing and discovered Mythos 5 and two other models had hacked three organizations during tests dating back to April.

In a statement, an Anthropic spokesperson said they are “grateful” to AISI for their leadership and that this review underscores the need for “a broader conversation about how to safely evaluate increasingly capable AI agents.”

The spokesperson added: “As we shared after disclosing our own incident last week, the field needs stronger, shared standards for how evaluation environments are built and secured. We look forward to partnering with the UK AISI to learn more about this incident as we conduct our own investigation.”

An OpenAI spokesperson referred POLITICO to a blog post about the incident that went up Tuesday evening. “We are committed to working across the industry to strengthen shared practices for conducting high-risk evaluations safely, including convening stakeholders such as national AI institutes, independent evaluators, other AI labs, and other groups in the coming weeks,” the blog read.

AISI stressed in its blog that the malicious activity it disclosed Tuesday took place under “deliberately permissive conditions” so they could assess the safety risks posed by the two models. This included granting the models access to the internet, unlike the earlier incidents detailed by Anthropic and OpenAI.

AISI also noted the models were intentionally stripped of internal guardrails that block malicious behavior. AISI was only able to disable those controls because of its role testing Mythos 5 and ChatGPT 5.6.

Still, AISI said the incidents highlighted the need for greater monitoring of model behavior during testing, and tighter controls over their access to the internet.

The Trump administration is finalizing a voluntary framework under which AI labs would submit powerful models they want to release to the public for federal safety testing. But it has not yet made the framework public, and it includes no provisions for models AI labs are developing internally.

The incidents last month from OpenAI and Anthropic both involved models not intended for public release.

Some cyber experts say recent incidents highlight deeper questions around AI development, such as who is liable when AI systems break federal hacking laws.

“If any of these were human-originated, they would lead to clear and vigorous prosecution. I think it’s time for a serious discussion about updates to existing computer security law,” said Marc Rogers, a hacker and prominent cybersecurity expert.

BRUSSELS — When French and German security chiefs announced plans last month to develop a “European sovereign digital backbone,” tech and defense industry insiders on both sides of the Atlantic knew what they really meant: Adieu Palantir.  

Across Europe, the hunt is on for alternatives to the U.S.-based data analytics company that a growing number of government officials believe is too deeply lodged in some of the most sensitive areas of government, from local policing and global intelligence to national defense and health systems. 

Yet it is precisely Palantir’s crucial functions in daily workflows, and its largely unmatched data expertise, that will make it extremely hard for Europe to cut it off in pursuit of greater digital sovereignty. 

“Let’s be honest, Palantir’s product is very good and addictive, it’s pretty much like the sugar in Coca-Cola,” said French digital sovereignty advocate, Philippe Latombe. “Palantir can treat massive amounts of data with great precision and with their experience, they had time to improve their algorithms with many clients and adapt them to many use cases.” 

Still, the drive to break free from Palantir is sweeping across the continent, from Madrid, where the government of Pedro Sánchez has instructed state-backed companies to block Palantir from future public procurement contracts, to France’s domestic intelligence services (DGSI) selecting French company ChapsVision over Palantir. In Britain, the next test may come in February 2027, when the new Labour government of Andy Burnham will face a choice of whether to cut off Palantir’s £330 million National Health Service Federated Data Platform contract. 

Last month’s decision by the French and German intelligence agencies to choose ChapsVision was a double-blow for Palantir’s leadership. CEO Alex Karp showed little patience for the sudden turn away from his company’s wares, declaring that he wasn’t worried about European competitors. “We have a model of what doesn’t work,” he quipped last week on Fox Business. “It’s called Europe.” 

Olivier Dellenbach, ChapsVision’s chief executive, told POLITICO that his company has benefited from what he calls a “visceral rejection of Palantir” in Europe.  

But he also cautioned that he did not want ChapsVision reduced to an anti-Palantir way out. Digital sovereignty, he argues, will remain an empty phrase unless governments turn it into industrial policy. “We need more public procurement,” Dellenbach said. 

Belgium, Germany, Luxembourg, Romania, the Netherlands and Canada have already shown interest in the French Army’s Artemis AI, according to Patrick Moreau, one of the architects of the solution built by French aerospace and defense company Thales. 

“They all want to be able to choose a sovereign solution that is compatible with NATO standards,” he said. “Unlike Palantir’s black box.” 

But for now, even officials who want sovereign alternatives acknowledge that Europe’s replacement market remains fragmented and European companies are yet to match Palantir’s scale and track record.

Admiral Pierre Vandier, NATO’s supreme allied commander transformation, recently told POLITICO the alliance has no viable alternative to Palantir’s battlefield AI technology.  

Another NATO official, granted anonymity to speak frankly, said that Palantir’s system has an unmatched capacity to sift through mountains of satellite imagery to help identify a target, advise on the weapon to strike it, inform how much ammunition is required — and automatically put in an order to replenish the stock. 

“As far as I know, today there is no real competitor for Palantir,” Vandier said in May. 

Freedom or democracy? 

Co-founded by Karp and billionaire investor Peter Thiel, Palantir built its reputation inside the U.S. national security apparatus. Today, the company has a market capitalization of $330 billion.

Thiel has been one of Silicon Valley’s most prominent supporters of U.S. President Donald Trump, while the company’s work with U.S. Immigration and Customs Enforcement (ICE) and the Israeli military has come in for criticism from Amnesty International and others for alleged human rights violations. Adding to unease about Palantir’s ideology-driven business were recent revelations of Thiel’s secretive Dialog society, an invitation-only ideas club for the global elite, and Karp’s manifesto arguing that Palantir is the democratic West’s best hope to stay ahead of authoritarian rivals.

“Peter Thiel explains that the defense of freedom does not necessarily require democracy,” French member of Parliament Aurélien Saintoul, who wrote a report on foreign military dependencies, told POLITICO. “He is clearly putting technical means to serve his political project, and we are talking about technofascists here.” 

A Palantir spokesperson who declined to be named dismissed such accusations as “ludicrous,” noting that similar characterizations about the company have been made recently by the Russian foreign ministry.

“We know what side we’re on, and who we’re standing with,” the spokesman said, citing ongoing work to support the Ukrainian military. “Since our inception, protecting privacy and civil liberties has served as the foundation for how we conduct our work across both public and private sector institutions. Western politicians should think hard about who the real enemy is and not allow themselves to be ventriloquized by the Kremlin.”

Many of the company’s European critics maintain that the Palantir question is much more about tech sovereignty than political ideology. Extracting the company from some of the most delicate corners of European security structures would offer a blueprint for claiming more technological independence.

Instead, if governments in Europe cannot wean themselves off a company that provides software solutions, it would reveal how unrealistic hopes are to reduce dependence on U.S. technology giants that provide cloud infrastructure and hardware.

There is also the uncomfortable reality that at the same time that political leaders are calling for a break from Palantir, Europe’s biggest banks and asset managers have dramatically increased their investments in the U.S. company over the past year as it positions itself to profit from the AI gold rush, reports investigative outlet Follow the Money.

From crisis tool to critical infrastructure

Palantir’s European foothold was built long before the current boom in AI. A hallmark of its growth was that it never wasted a crisis to demonstrate its value for governments in need.  

In France, for instance, Palantir arrived in the aftermath of the November 2015 Paris terrorist attacks as security services scrambled to respond to a fervent public backlash on how they could have allowed such a tragedy to happen. The domestic intelligence agency signed a contract with the data analytics giant in 2016. 

A similar pattern played out in Germany, where Palantir’s first major deployment came in Frankfurt, in the central state of Hesse, where police purchased Palantir’s Gotham in 2017 and deployed it under the name hessenDATA. It proved to be a crucial tool for officers to turn sprawling information into leads to help solve crimes.

Germany remains deeply divided over whether to use Palantir’s software. At the national level, Interior Minister Alexander Dobrindt has pushed to expand the use of Palantir and introduced legislation that could pave the way for broader federal use. But the move has run into opposition from coalition partners the Social Democrats, as well as senior security officials.

The same crisis-to-contract pattern appeared in the U.K. during the Covid-19 pandemic. Palantir’s relationship with the National Health Service (NHS) began when it was paid a nominal £1 fee to help aggregate data during the crisis, according to Palantir’s U.K. lead Louis Mosley. 

Europol, the EU’s police agency, used Palantir’s Gotham platform from 2016 to 2021 before ultimately dropping it. For one Europol official who was granted anonymity to discuss the matter freely, the problem with Palantir is less ideological than practical. Yes, the platform is expensive, raises sovereignty concerns and leaves clients dependent on Palantir for updates, the official said. But the more basic question is whether every agency needs the full Palantir machine. 

“[Palantir] is really good when you have massive amounts of data and want to connect everything,” they said. “But that is not the case for us. In many cases, the alternatives are close enough. If we used it, I’m not sure our efficiency would increase dramatically.” 

Part of Palantir’s approach in Europe is to hire former officials from the institutions it wants as customers. OpenDemocracy reported that Palantir hired four former officials from the U.K.’s Ministry of Defence before winning a £240 million MoD contract.

The influence drive 

Moreover, Palantir is now seeking new business on the continent in defense.

On Jul. 1, Palantir’s Maven Smart System — which was first used by the Pentagon — became fully operational at NATO, meaning it’s been given security clearance to operate on the classified network. According to a NATO statement, the platform links command-and-control systems across the Alliance. 

“I think this is a very important milestone for European defense,” said Palantir’s U.K. chief Louis Mosley. 

But Palantir’s grip on Europe does not stop at the doors of government or army barracks. It also runs through some of the continent’s industrial crown jewels. Airbus signed with Palantir in 2015, making Palantir’s Foundry the backbone of its aviation data platform. Automaker BMW, energy company British Petroleum and media publisher Axel Springer — POLITICO’s parent company — all use Foundry to improve their business productivity as well. 

Looking for alternatives 

Even if Europe manages to loosen Palantir’s grip, the company’s model built on top of the latest AI large-language systems appears to only be getting stronger. On Jun. 30, Amazon Web Services said it would invest $1 billion in a new “Forward Deployed Engineering” organization, embedding teams of engineers inside customer headquarters to build AI systems alongside them.  

Days later, Microsoft announced a $2.5 billion push to send 6,000 engineers and industry specialists into client organizations. Both initiatives echo Palantir’s pioneering model to not simply sell software but put engineers inside a buyer’s operation. 

Both the strength of its products and the sensitive areas where they’re applied, make Palantir Europe’s sovereign test case par excellence. If governments and companies can replace a software layer that helps turn data into decisions, they may have a blueprint for clawing back some digital sovereignty. If they cannot, the next generation of AI tools from U.S. tech giants may prove even harder to quit. 

“Europe’s public institutions cannot become dependent on software built by a small circle of U.S. tech billionaires with an obscure political worldview,” said German Green MEP Hannah Neumann, who sits on Parliament’s defense committee. “It would be like outsourcing part of the democratic state to a private intelligence service that answers neither to voters nor to parliament.”

David Pargamin contributed reporting from Paris.

MANCHESTER — Labour’s Bev Craig won the Greater Manchester mayoral by-election Friday night and will now succeed British Prime Minister Andy Burnham in the region’s top job.

Craig came top with 309,525 votes, with Reform UK’s Sian Astley trailing on 157,178 votes. The Green Party placed third.

The victory was achieved with a second round under the city’s supplemental vote system, which allows voters to pick a first and second-preference candidate.

Speaking at the Co-Op Live arena to the east of the city, Craig said she stands “ready to serve” her 3 million constituents.

“Every single decision I take as your mayor of Greater Manchester will pass the test of making your life better,” Craig pledged.

The vote was triggered after three-time mayoral contest winner Burnham resigned the job in June to return to Westminster, where he swiftly claimed leadership of the governing Labour Party and became prime minister. There had been concern that Burnham’s move would allow Reform UK — which performed strongly in local elections in England earlier this year — to seize the mayoralty.

Craig will now be have to deal directly with Burnham, who has promised to devolve more powers to England’s mayors as a part of a devolution package. The post currently comes with powers over transport, policing, and housing.

Turnout for the special election was noticeably lower than when Burnham last ran back in 2024, with only 25 per cent of voters heading to the polls this time, compared to 32 per cent at the last vote. POLITICO witnessed some voters on doorsteps Thursday evening learning of the election for the first time.

Counting continued late into the night as the re-instated supplementary voting system took the contest to a second round for the first time ever.

Reform diverted

In the weeks before the election, polls put Craig firmly in the lead. Reform UK had initially been expected to pose a strong challenge, but some of its resources were diverted South as Nigel Farage called a separate by-election in his constituency of Clacton in a bid to shut down scrutiny of his finances.

The Greens set about targeting areas in which they knew they already had support. While out door-knocking in Longsight, an area in the constituency of Gorton and Denton, candidate Geraldine Coggins said they were “going for the hat-trick,” after winning a councilor and an MP in recent votes. Zack Polanski’s party threw money at an air campaign, too, pumping out Instagram videos featuring the leader, Gorton and Denton MP Hannah Spencer, and Coggins.

Greater Manchester has a huge electorate of 2.1million voters, and there were only 5 weeks to campaign. “You can’t hit all those doors,” explained Coggins.

Coggins’ Instagram account reached 4.6million views in the past 30 days and campaign ads had been shown on screen 50.7million times, according to her team.

Meanwhile, Craig spent some £53,000 on digital ads between Meta and Google, and told POLITICO before the vote: “People have been stopping me in the street. And I’ve been really high-profile and visible in my campaign even when other parties went hard on their attacks.” A yellow Labour battle bus cruised the streets as voters went to the polls Thursday. One campaigner shouted “Vote Bev today” through a microphone while fellow activists cheered and waved posters from the top deck.

Meanwhile, Reform seemed to have toned down their own efforts. One Bolton resident said they had not received a single campaign leaflet from Reform, which traditionally relies on social media and letters rather than door-knocking, despite receiving an influx during the local elections in May where the party made big strides, especially in the north of the city region.

The party’s candidate Sian Astley drew some criticism for backing out of hustings hosted by local media outlet the Manchester Mill, and spent just £14,000 on digital ads.

CORRECTION: This article has been updated to correct the name of Reform UK’s candidate.