Vetted-list cyber models matter only until open-weight models catch up — resolves 2026-12-31

The debate: Anthropic (April), OpenAI (June) and Google (September) each released a cyber-only model with no public price, available only to defenders who pass vetting, and the question everyone asks is whether that gate keeps attackers out.

Why it matters: the same capability lets defenders patch holes and attackers find them, and the UK AI Security Institute, the UK government's AI evaluation body, measures open-weight models (weights published for anyone to download and run) trailing the closed frontier on cyber by only 4 to 7 months, a gap that is shrinking.

Who is on each side: the three labs implicitly bet that vetted lists really control the spread; our call is that the gate lasts only as long as open-weight models take to catch up, and every score the three labs cite sits on the fastest-closing kind of capability.

Our call: the three labs did converge on the same approach, and there are three of them, not two: the first was Anthropic's Project Glasswing in April 2026, two months before OpenAI. Two claims from SecondSource's September 3 brief do not hold, though. "Within 72 days" is wrong, since the line runs about five months, and the gate did move: from invitation by the vendor to application by the user, with each later company disclosing less.

How long the gate matters depends not on how strict the vetting is but on how soon open-weight models catch up. The UK AI Security Institute measures two gaps: narrow vulnerability-finding tasks trail by 4 to 7 months, while long, multi-step attack exercises trail by more. Every score the three labs cite to justify the gate measures the narrow, faster-closing kind.

The original material behind this call has not yet been linked here in a form readers can open and check.

Earlier checkpoints:

① The UK AI Security Institute's next quarterly measurement: does the cyber gap between open-weight and closed models keep narrowing from today's 4 to 7 months?

② Does any of the three labs publish an approval rate or how long review takes?

③ Do Google or OpenAI disclose which difficulty tier or subset of CyberGym they ran? (CyberGym is a public test from a Berkeley team that asks a model to reproduce a vulnerability described to it.)

Later checkpoints:

④ The UK AI Security Institute or the US CAISI (the AI evaluation body under NIST) measures the gap for a specialised cyber model for the first time. This is the one measurement SecondSource has asked for; no institution has committed to it.

⑤ Any specialised cyber model moves to a public list price (a 12-month window set by SecondSource).

⑥ Any open-weight model publicly reaches the 85-point range on CyberGym or a comparable successor test.

What would overturn it

① Any of the three labs publishes an approval rate. Above 90%, the vetted list is sales routing rather than control, and the lifespan argument shrinks to "a mechanism that never bit". Clearly below 90% with named rejections, the reading that the list really controls access gets its first evidence.

② Any specialised cyber model moves to a public list price within 12 months: the list was a staged launch, and the reading that control has moved from the model to the release process is void.

③ The UK AI Security Institute or CAISI measures a gap for specialised models clearly longer than 7 months: the clock moves back, and the January–April 2027 range estimated for open-weight models catching up is void.

④ Any open-weight model reaches the 85-point range on CyberGym: all three gates lose their technical meaning, and the question is closed.

⑤ Any lab discloses a way to trace outputs back to the copy that produced them, the equivalent of a watermark: the argument that the route which rescued Cobalt Strike (a commercial penetration-testing tool whose cracked copies attackers abused widely) does not work this time has to be re-examined. This is the most likely single point of failure.

⑥ A second government order revokes access (the first, in June 2026, was a US export-control directive under which Anthropic had AWS withdraw Claude Fable 5 and Claude Mythos 5 from all users three days after launch): revocation becomes a feature of the mechanism, and buyers' main risk shifts from leaks to loss of supply.

Read the full deep dive →