The most consequential thing about the cyber models Google, Anthropic and OpenAI pushed out over the past week is not what they can do. It is who is allowed to ask.
All three labs shipped frontier-grade, offensive-capable systems behind application-only doors — Google's Fairwind Program, Anthropic's Project Glasswing and Cyber Verification Program, and OpenAI's two-tier Daybreak Blue and Daybreak Red. A week on, the durable story is the architecture underneath: three competitors independently converged on the same governance primitive, in which the same weights behave differently depending on whether the customer passed a vetting process.
The pattern is explicit in the product design. Gemini 3.8 Flash and Gemini 3.8 Flash Cyber are, in Google's own description, "powered by the same foundational intelligence" — the Cyber variant simply "ships with a more permissive set of mitigations for cybersecurity, and as such, is only available to trusted defenders." Anthropic released Claude Fable 5.1 broadly and routed Claude Mythos 5.1 through trusted access only. OpenAI splits the difference at the account layer: general users of GPT‑5.6 Sol hit system-level guardrails, Daybreak Blue members get those guardrails removed for defensive work, and the purpose-trained GPT‑5.6‑Cyber sits behind Daybreak Red.
The gate, not the model, is the product
The numbers make clear how much the gate is doing. On OpenAI's own Advanced Cybersecurity Completion Rate metric, GPT‑5.6‑Cyber completes 95% of a set of sensitive requests spanning exploit-chain development, authentication bypass and privilege escalation. The publicly available GPT‑5.6 Sol completes 1.5% of the same set — and only 2.0% even with Daybreak Blue access. The previous cyber model, GPT‑5.5‑Cyber, managed 57.3%. That is not a capability difference; for the Sol tiers it is entirely a permissions difference, and it is a roughly 60-fold swing decided by an application form.
Google's version is scale plus contract. Fairwind has more than 650 participating partners globally, including CrowdStrike, Datadog, Palo Alto Networks and Snowflake, with initial access staged for national cyber authorities, critical-infrastructure operators and core technology platforms. Participants "agree to strict operational standards, including limiting access to employees within their internal cybersecurity, incident response, or penetration testing teams and deploying protections like multi-factor authentication." OpenAI has gone further on identity: individual Daybreak accounts have required hardware security keys since September 1.
The capability being gated is real. Gemini 3.8 Flash Cyber exceeds a 70% success rate on Google's internal vulnerability-discovery benchmark spanning 20 programming languages, and scores 47.2% pass@1 on CWE-Bench, the external patching benchmark run by Collinear — statistically level with a leading frontier model's 47.8% at a fraction of the cost. Google's Chrome Security team reported the model produced 2.6 times more correct patches to Chrome vulnerabilities than the best, much larger commercial models, and its Cloud Vulnerability Research team said it found a critical foundational vulnerability in under two hours, work that normally takes months.
Anthropic has settled on a fourth model of gating: don't hand over the model at all. Rather than direct API access, defenders increasingly consume Mythos 5 through purpose-built interfaces that return only a defined output. "Claude Security uses Mythos 5 to scan code you own, and returns detailed findings rather than raw outputs without exposing the model itself," the company explained. "This means defenders can access the capabilities of Claude Mythos 5 without the model becoming accessible to those who might misuse it." Project Glasswing now spans roughly 150 organizations across 15 countries, and Anthropic has committed $35 million in Claude credits through its Defender Advantage Fund to groups helping open source maintainers.
Why It Matters
Access gating has quietly become the industry's most-used safety control — and it is a strange one, because it is not a property of the model. It is a contract and an identity check. Every lab has now conceded that alignment training alone cannot make a zero-day-finding system safe for anonymous public use, so the safety boundary has migrated from the weights to the customer roster.
That has real benefits. Google frames it as a head start: early access gives trusted defenders "a vital adaptation window to harden their systems before bad actors have a chance to exploit new capabilities." Anthropic makes the same wager.
But the offense/defense math is uncomfortable. These programs favor exactly the organizations that were already best defended — governments, hyperscalers, Fortune 500 security teams, national CERTs. The hospital, the municipal utility and the two-maintainer npm package that anchors a supply chain do not have a Daybreak account. Google's $36 million for 35 cyber clinics and Anthropic's open source fund are attempts to patch that gap, but they are philanthropy layered on top of a market structure that concentrates advantage.
There is also a control-plane question the labs cannot answer for you. Commenting on OpenAI's tiering, Alex Goller, principal solution architect for EMEA at Illumio, called it "a good first step" but warned that model guardrails were never the real control. "These are agents operating inside your environment and the controls that matter follow zero trust principles," he said. "There must be visibility into what the agent is doing and what it can reach, and then segmentation to contain the blast radius when something goes wrong." His conclusion is the one security leaders should tape to the wall: "that enforcement lives in your infrastructure, not in the model."
And gates leak in ordinary ways — the 650th partner, a compromised session, a contractor with a Fairwind seat. None of the labs claim otherwise.
What to watch
Three things. First, whether Anthropic's Cyber Verification Program actually extends Mythos-class access beyond Glasswing, as promised "in the coming weeks" — the first real test of scaling a vetted tier. Second, whether any regulator treats these rosters as critical-infrastructure policy rather than vendor terms of service; right now private companies are deciding which defenders get to be strong. Third, false positives: OpenAI has already warned that Astra's safeguards "may erroneously flag legitimate activity as cyber misuse." A gate that blocks the wrong defender mid-incident is not a safety control. It is an outage.
“These are agents operating inside your environment and the controls that matter follow zero trust principles... that enforcement lives in your infrastructure, not in the model.”— Alex Goller, Principal Solution Architect for EMEA, Illumio