OpenAI, Google and Anthropic put their strongest cyber models behind gates
· TexaHub · LLMs & Foundation Models, Regulation & Ethics, Risks & Opportunities
In one week three labs shipped models with advanced offensive-security skills, and each chose vetted-access programmes rather than general release for the most capable versions.
A shared release pattern
Between 1 and 3 September, OpenAI, Google and Anthropic each released a frontier model alongside a more capable, cyber-oriented variant or mode reserved for vetted users. The Hacker News, summarising the three announcements on 2 September, described cyber models, safeguards and access programmes arriving from all three companies at once [1].
The common thread is a two-tier approach: general availability for a model whose cyber behaviour is constrained, and restricted access for the version that can do the most. The labs differ in how they describe the risk, and in how far their most capable systems are said to go.
OpenAI's first 'Critical' rating
OpenAI said its Astra model is the first of its systems to meet the "critical" cybersecurity threshold, which Fortune reported means it can "find and exploit previously unknown security flaws without human oversight, under the right conditions" [2]. TechCrunch reported that Astra achieved a perfect score on ExploitBench and discovered and exploited two zero-day vulnerabilities in testing [3]. The Hacker News put the predecessor GPT-5.6 Sol's ExploitBench score at 78.5% [4].
Fortune reported that OpenAI cited a refusal rate of 91.5% for Astra on inappropriate requests, against 59% for GPT-5.6 Sol [2]; The Hacker News described the same figures as the share of jailbreaking requests declined [1]. Full access was initially limited to alpha testers including the US government, members of OpenAI's trusted cybersecurity access programme and entities responsible for protecting critical digital infrastructure, with expansion planned through a "Daybreak Blue program" [2].
When Astra launched on 3 September, TechCrunch reported that Daybreak customers would get it first, with paid ChatGPT plans and the API to follow the next week [5]. According to The Hacker News, the broadly distributed version is "limited to secure code review and patching" and refuses prompts to build proof-of-concept exploits, and OpenAI announced a $1 billion commitment through Daybreak for Frontline Defenders to subsidise access for sectors such as water, electricity and state and local government [4].
The release was not only about cyber. TechCrunch reported that Astra uses a technique it called "opaque recurrence" that makes chain-of-thought monitoring harder, quoting chief scientist Jakub Pachocki: "as model capabilities are increasing, monitorability is getting more challenging" [5]. TechCrunch's earlier report noted that without independent verification, "it is difficult to evaluate OpenAI's claims about safety or preparedness" [3].
Google's Fairwind and Anthropic's Mythos
Google released Gemini 3.8 Flash and a separate Gemini 3.8 Flash Cyber on 2 September [6]. Google says the Cyber model succeeded more than 70% of the time at discovering vulnerabilities across 20 programming languages in an internal benchmark, scored 47.2% pass@1 on CWE-Bench patching, and produced "2.6 times more correct patches to vulnerabilities in Chrome than the best commercial models" [6]. Unlike OpenAI, Google framed the model around repair rather than exploitation. Google also cited early partner results, including penetration-testing recall gains of 7.5% to 9.7% at 2.3 to 5.2 times lower cost reported by Wiz [6].
Access runs through a new Fairwind Program, which Google describes as "a limited access program for governments and trusted partners to use our cyber defense tools" [7]. Participants must limit use to internal security, incident-response and penetration-testing teams and deploy protections such as multi-factor authentication; Google says more than 650 partners take part [7]. The general Gemini 3.8 Flash model is priced at an introductory $0.75 per million input tokens and $3.75 per million output tokens [6], which The Register reported will double in the new year [8]. Alongside the programme, Google.org committed $100 million globally for cybersecurity, including $36 million for 35 cyber clinics supporting more than 1,250 hospitals, school districts and municipal utilities in the US [7].
Anthropic's Claude Mythos 5.1 is the same model as Claude Fable 5.1 but with safeguards designed for cybersecurity and life-sciences work, and is restricted to vetted users through verification programmes [9]. Anthropic calls it "the strongest cyber capabilities of any model we've released", but says its evaluations show it "still falls short of the next risk tier defined in our Responsible Scaling Policy" [9]. Mythos 5.1 is available only to a set of US organisations for now, while the general Fable 5.1 still redirects penetration testing, exploit generation and binary-based vulnerability scanning to Anthropic's Opus models [9]. For Fable 5.1, Anthropic says its cyber safeguards now trigger around 60% fewer interventions per session than in earlier versions [9].
What the gates do and do not settle
Gated access is now the default for top-end cyber capability among these three labs, but the gates rest on different foundations. OpenAI has declared a threshold crossed under its Preparedness Framework [1]; Anthropic says its model has not crossed the next tier of its own policy [9]; Google emphasises defensive patching and operator controls [7]. Because each lab measures against its own framework and partly its own benchmarks, the announcements do not allow a like-for-like comparison of how dangerous the restricted models are.
Several questions remain open. Vetting criteria for programmes such as Daybreak Blue, Fairwind and Anthropic's verification tracks are set by the companies themselves, and OpenAI has said it plans to roll out less restrictive safeguards in the coming weeks [4]. How quickly access widens, and whether outside testers can reproduce the headline cyber results, will determine whether this week's restraint is a durable practice or a launch-period posture.
Sources
[1] Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs — The Hacker News, 2 Sep 2026
[2] OpenAI to limit access to Astra model's advanced cyber features due to hacking concerns — Fortune, 1 Sep 2026
[3] OpenAI's Astra model is on the way — and very good at breaking into computer systems — TechCrunch, 1 Sep 2026
[4] GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests — The Hacker News, 4 Sep 2026
[5] OpenAI launches Astra, its powerful (and controversial) new model — TechCrunch, 3 Sep 2026
[6] Introducing Gemini 3.8 Flash and 3.8 Flash Cyber — Google, 2 Sep 2026
[7] Proactive cyber defense for governments and enterprises — Google, 2 Sep 2026
[8] With Gemini 3.8 Flash, Google reminds everyone it's still in the race — The Register, 2 Sep 2026
[9] Introducing Claude Fable 5.1 and Claude Mythos 5.1 — Anthropic, 1 Sep 2026