Paris keeps its cyber testing at home as Mistral gets the work OpenAI cannot

France will use “sovereign” AI providers such as Mistral, not OpenAI, to test government systems for security vulnerabilities, Budget Minister David Amiel said Tuesday.

The announcement came days after a breach at the national tax agency exposed data of about 700,000 taxpayers.

“This excludes OpenAI”

After a cabinet meeting in Paris, Amiel told reporters the state would turn to what he called sovereign AI companies, “such as Mistral,” to do the work. “This excludes OpenAI,” he said.

Amiel had confirmed the plan itself earlier that day. The government would use AI tools to identify its own services’ vulnerabilities to cyber attacks. The catalyst was the tax agency breach disclosed the previous Thursday. The French Finance Ministry said the data of some 700,000 taxpayers had been taken.

Mistral, the Paris startup backed by chipmaking-equipment supplier ASML, has become the go-to company for France when it wants to demonstrate it can operate critical systems without relying on American technology.

In June, Amiel unveiled a government plan called “Notre IA,” or “Our AI,” to distribute sovereign tools across public services. The state digital agency DINUM developed its centerpiece, an assistant called “L’Assistant,” based on Mistral’s model and hosted it in SecNumCloud-certified datacenters. The tool was being rolled out to close to a million state employees.

A breach that keeps growing

France’s tax administration chief Amelie Verdier said Monday that her teams had uncovered a second data breach. She said the intrusion is still being assessed.

Earlier this month, Cryptopolitan reported the first breach was on the Directorate General of Public Finances. A compromised internal VPN was used by an attacker to reach a taxpayer search tool using a stolen identity, the DGFiP said.

The access was traced back to late June 2026 and was closed by the end of the month. By that time, the attacker had already seen and pulled records.

The data include names, birth details, postal and email addresses, telephone numbers, tax identification numbers, withholding rates, and correspondence with officials, the DGFiP said.

The agency said usernames and passwords were not among the exposed data. France’s privacy watchdog CNIL was notified, and the DGFiP said it would file a criminal complaint.

France has been hit by a wave of violent attacks on crypto owners in 2026, Cryptopolitan has reported. In April, Telegram founder Pavel Durov said on X that the country had seen 41 kidnappings of crypto holders in the first three and a half months of the year. He blamed leaked personal data, including records held by tax authorities.

If you're reading this, you’re already ahead. Stay there with our newsletter.