Three frontier labs now hand out cyber models by vetted list, not by price; our call: how long that gate matters is set by how fast open-weight models catch up, which the UK's AI Security Institute measures

Key takeaways

On September 2 Google released Gemini 3.8 Flash Cyber, a model built only for security work. The official announcement carries no price anywhere. The announcement says instead that the model is "available to trusted defenders through our new Fairwind Program". OpenAI's GPT-5.5-Cyber on June 22 has the same shape: a security-only sibling of a general model, no public price, eligibility limited to what both companies call trusted defenders.

The conclusion of this piece has two halves. The first half is a correction. This is not two companies but three, and the first was not OpenAI but Anthropic, in April, two months before OpenAI. Project Glasswing put the unreleased Mythos model in the hands of roughly fifty organisations that run critical infrastructure. The second half is the point. All three companies are doing the same thing. The obvious way to judge the gate is its approval rate: who gets through and who does not. None of the three has published that number and none will soon. The number that actually sets how long this gate stays meaningful is a different one, and a government agency measures it on a schedule. The UK's AI Security Institute found that open-weight models trail the closed cyber frontier by 4 to 7 months, down from the 6 to 10 months it measured through most of 2025. The models it tested were Zhipu's GLM-5.2 and DeepSeek V4-Pro, compared with closed frontier models on AISI's cyber evaluations. A vetted list controls who reaches the model through the vendor's API. It does nothing about open-weight models, and AISI publishes how far behind those are.

The route runs in five steps:

① Fix the timeline: three companies, five months, three different shapes, and the first company disclosed the most.

② Explain what the vetted list replaced, and why its cost is not zero: the product does have a price; it is paid in data rather than money.

③ Examine what the benchmark two of the three cite as proof (CyberGym) actually measures. The answer changes how OpenAI's self-reported 85.6% on CyberGym, against 81.8% for the general GPT-5.5, should be read.

④ Convert the gate's lifespan into dates, and point out something more pressing: the capability axis the three companies cite as justification is exactly the axis with the shortest lifespan.

⑤ Look at the failure that has already happened. The gate has already been shut once on AWS. It was a government directive, not a leak, and it took three days.

What does this piece add to yesterday's daily brief on the same story? Three things, each of them checkable. First, three parts of yesterday's judgment did not hold. The count is three companies, not two; the line starts with Anthropic in April, not OpenAI in June; and the gate did move, from invitation to application, with less disclosed at each company's first move. Second, the yardstick was taken apart. CyberGym hands a model a written description of a vulnerability plus the code and asks for a test that reproduces it. CyberGym measures reproducing a vulnerability the model has been told about, not finding one nobody knows about. The latter is the capability that needs a gate. Third, a condition that would overturn this piece has been written down, and it has a named recipient. The UK's AISI and CAISI, the US evaluation body under NIST, already measure the open-weight cyber gap, but what they have measured so far are general-purpose frontier models. All three companies released specialised models. Pointing the same yardstick at the specialised models once would replace this piece's estimate of when open-weight models catch up with them with a measured figure. That measurement does not exist today, and the only institutions equipped to produce it are those two.

The line in the tree is about a control surface changing address. Before 2026, a frontier lab's answer to "this capability will be used by the wrong people" was to train refusals into the model. From April 2026, three labs switched to building a separate, unrestricted version and handing it only to people on a list. This piece deals with the most practical question on that line: how long the new approach stays fresh, and who decides that.

One: get the count right. Three companies, five months, and the first disclosed the most

The skeleton of yesterday's judgment was two companies, 72 days, independent convergence. The count and the window have to change; independent convergence itself survives. There was also a claim outside the skeleton that does not survive either: that the gate "has not moved at all". Together that makes three corrections.

One term needs defining first. Vetted-list release means the product carries no price and is not sold publicly; a would-be user applies, and the vendor decides. Its opposite is allocation by price: a listed price, available to anyone who can pay, and the vendor does not ask who the buyer is.

In date order:

The three corrections in turn.

First, the count is three, not two. As Stratechery reported, Anthropic did the same thing in April, and did it harder than the other two: Mythos was not even a restricted release, because it was never publicly released at all. Logan Graham, who runs Anthropic's Frontier Red Team, gave safety confidence as the reason at the time, as relayed by Stratechery: the company had to be sure releasing the model was safe, and what full confidence would look like was not yet clear to Graham.

The AWS announcement in June spelled the mechanism out: "The same model without these limits is Claude Mythos 5 and it will only be available to a small group of vetted customers."

The effect on yesterday's judgment cuts both ways. The bad news is that "two companies converged independently" has to be rewritten. The good news is that the judgment got stronger. Yesterday's item listed, as its own third overturn condition, a third frontier lab releasing a security model without a gate. The third lab has now been found, and not only did it build a gate, it built the strictest of the three. Convergence holds, and the sample went from two to three.

Second, the window is five months, not 72 days. Yesterday's 72 days ran from OpenAI's June release to Google's second model in September. That count skipped Google's first model, Gemini 3.5 Flash Cyber, released on July 22. The real gap from OpenAI to Google is 30 days. The whole line runs from April to September 2026, about 150 days.

Third, and most important: the gate did not stand still. Comparing each company's first move, disclosure fell at every step. The last column of the table shows it. The first company published a count and five named members. The second published seven national partners but no organisation count. The third gave a programme name. The mechanism's shape changed at the same time. Glasswing was an invitation: the vendor picked the members, so the headcount had a natural ceiling. Fairwind is an application: users apply, and no ceiling has been announced.

Taken together, disclosure dropped at exactly the point where the approval rate started to mean something. For an invitation list of fifty, the approval rate barely matters; the list is the list. For an application scheme with no ceiling, the approval rate is the only thing that tells control apart from a front desk. And that is the step after which it stopped being disclosed.

Two: the list replaced refusal training, and the price is paid in data and auditability

To see why all three went this way, start with what the list replaced.

One more definition. Dual-use means the same capability lets a defender patch their own holes and lets an attacker find someone else's; technically it is one skill. Before this year, the standard way frontier labs handled such capabilities was refusal training: train the model to decline certain classes of request. That approach has one much-repeated flaw. It applies to everyone at once. A determined attacker routes around it, and the person actually stopped is the security engineer trying to fix a hole in their own system. The sharp version of the critique is that a refusal policy is a tax that only defenders pay.

The vetted list is the response to that critique. Instead of refusing everyone, build a separate uncut version and give it to defenders. Anthropic's implementation lays the logic out most plainly. Fable 5 is the version with safeguards, and the AWS announcement describes how the safeguard works: "Harmful prompts related to cybersecurity, biology, chemistry, and health fall back to receive a response from Opus 4.8 instead." The guardrail is a routing decision, not a retrained model. Dangerous questions go to a weaker, older model. Mythos 5 is the same model with that route removed.

So the substance of the vetted list is this: the judgment "who can be trusted" moves from the model's real-time response into one company's administrative process.

There is an inference error here that is easy to walk past, and worth a pause. Yesterday's item said this product "isn't expensive, it has no price field at all". But the announcement prints no price and the product is not allocated by price are two different statements. The first is observable; the second is an inference. One instance shows what that inference left out. The AWS announcement states that to reach the model at all, a customer must opt into data sharing, and that "Anthropic requires 30-day inputs and outputs retention, as well as human review."

So access does have a cost, paid in data and auditability. The customer hands over thirty days of everything sent into the model, retained and read by people.

The mirror image sat in the other news of the same day. On September 2 Meta released Muse Spark 1.3, whose cheapest tier charges US$0.10 per million input tokens, and the condition of that price is letting Meta use the customer's prompts as training data. The two are one structure: for the cheap model and for the controlled model, the real price column is not the one denominated in money. For a company that would be sending customer data or internal code into either, neither is a pricing question. Both are legal questions.

Three: the yardstick measures reproducing a vulnerability the model was told about

Two of the three companies cite the same benchmark as proof. OpenAI's Daybreak announcement reports GPT-5.5-Cyber at 85.6% on CyberGym against 81.8% for the general GPT-5.5. Google's model page states that "Gemini 3.8 Flash Cyber leads with 86.2%". The two numbers differ by 0.6 points. Yesterday's item read this as two companies proving themselves with one yardstick. That is right, and what the yardstick measures deserves a closer look.

CyberGym is a public benchmark built by a team at UC Berkeley, with a paper published in 2025. The scale is not small: 1,507 real vulnerabilities across 188 open-source projects, drawn from Google's OSS-Fuzz. The key is what the model is given and what it is asked to do. The paper describes the task as producing a proof-of-concept test that reproduces the vulnerability, with the model given only the vulnerability's written description and the corresponding codebase.

Where the vulnerability is and what it is are given to the model up front. The model's job is to turn that description into a test file that actually triggers the crash. That is a valuable capability, and it is the first half of patching: a fix cannot be verified until the bug reproduces reliably.

But it is not finding an unknown vulnerability in a large body of code that nobody has examined. That second capability is the one that needs a gate. An attacker has no use for reproducing a vulnerability already published in a CVE database; that information is public by construction.

A second fact belongs on the record. The paper reports that even the best-performing combination it tested reached only around a 20% success rate. From about 20% in 2025 to 85.6% in 2026 is roughly four times in a year. That ratio is this publication's own calculation, and it is not like for like. The 20% came from the combinations the paper tested, and the 85.6% is OpenAI's self-reported score on a subset it has not named. The jump may be real: a model's ability to plan and execute multi-step tasks on its own did leap this year. But two things have not been published: none of the three companies says which difficulty tier or subset was tested, and no third party has reproduced any of the scores. Both numbers in the mid-80s currently rank as vendor self-assessment.

The benchmark's own authors published, in 2026, CyberGym-E2E, a paper accepted at ICML 2026. Its opening states that existing cyber evaluations of AI systems are limited in scale or scope and fail to cover the end-to-end lifecycle of finding and patching real-world software vulnerabilities. The new version covers 920 vulnerabilities across 139 projects and chains discovery, proof of concept and patch into one evaluated workflow.

The same authors open their follow-up paper by saying existing evaluations are limited in scale or scope. That is a general remark, but what they then built is exactly the stage the old version did not cover. In the same year, two frontier labs cite the old version's score as the justification for the gate. 85.6% may well be accurate, but it measures reproduction and cannot answer the question the gate exists to answer.

(Google reports two further numbers: a "pass@1 of 47.2%" on CWE-Bench, a patching benchmark, where pass@1 is the share solved on the first attempt, and an internal vulnerability-discovery test with a "success rate exceeding 70%". The internal test cannot be checked. The 47.2% is the one externally comparable figure, and it sits far below the 86.2%.)

Four: the gate's lifespan is not set by the gate, and the number that sets it is being measured

Asking whether the gate keeps people out is natural, but nobody has data to answer it, and none of the three companies offers any. A different question does have data: how far along is the path that goes around the gate?

A gate only means something if the same thing is not available outside it. A vetted list can block the path that runs out of a gated API. What it cannot block is the other path: open-weight models, which run on anyone's own hardware, where no list reaches.

How far that path has come is being measured, and by a government. On July 17, 2026 the UK's AI Security Institute published its first quantification of how far open-weight models trail the closed cyber frontier. The AISI report says:

"Recent open models GLM-5.2 and DeepSeek V4-Pro perform similarly to frontier closed models released 4 to 7 months before them – a narrower gap than the 6 to 10 months we measured through most of 2025."

The same report has a sentence aimed straight at this piece's subject. AISI writes that "cyber defenders have a short window to prepare before today's frontier cyber capabilities may become accessible without the same safeguards".

Converted into dates: Google's model shipped on September 2. A gap of 4 to 7 months puts open-weight capability of the same grade somewhere between January and April 2027. That conversion carries one explicit caveat, covered in the second point below.

The date is not the thing to watch, though. The thing to watch is AISI's second finding in the same report. The gap is not one number but two:

• On narrow cyber capabilities (70 evaluations), the gap is 4 to 7 months.
• On long-horizon, multi-step operations (AISI's cyber range called "The Last Ones"), AISI states that "The gap here is larger than on our narrow cyber tasks".

So this gate has two different lifespans on two capability axes: narrow vulnerability work, measured in quarters; long-horizon multi-step operations, much longer.

Against that split, what the three companies cite as proof: CyberGym (reproducing a described vulnerability), CWE-Bench (patching), an internal discovery success rate. Every one is a narrow task. Not one of the three defends the gate with a long-horizon operations score.

The three companies built the gate on the axis with the shortest lifespan, and use that axis's scores to argue the gate is necessary. This is not necessarily bad faith: narrow tasks are easier to test, and long-horizon evaluations are genuinely hard to build. The capability the gate protects is the kind open-weight models catch up on fastest.

Two weaknesses in this calculation have to be stated plainly, because both could push that date range later:

First, AISI measured general-purpose models; the three companies shipped specialised ones. AISI compared GLM-5.2 and DeepSeek V4-Pro against Claude Opus 4.6 and GPT-5, all general-purpose frontier models. Fairwind and Trusted Access hand out security-specialised models. Google's own announcement says 3.8 Flash Cyber "surpasses both 3.5 Flash Cyber as well as significantly larger frontier models". If that sentence holds, specialisation carries a real premium, and that premium has never been measured by anyone. What open weights have to close may not be 4 to 7 months but 4 to 7 months plus a specialisation gap of unknown size.

Second, the gap itself is moving. It shrank from 6 to 10 months to 4 to 7. Extrapolating from a moving number yields a range, not a date.

Both points lead to one action, and it is the action this piece rates most worth taking: point AISI's yardstick at the specialised models once. That measurement does not exist today. It requires no one to volunteer an approval rate; it needs only existing open-weight models and the benchmarks the three companies already cite. The institutions able to run it are already running this kind of test: in July 2026 the UK's AISI and CAISI, the US evaluation body under NIST, jointly assessed the cyber capability of Moonshot AI's open-weight Kimi K3, at 32% on a benchmark called ExploitBench against 24% for Zhipu's GLM-5.2. The same method aimed at the specialised models replaces this piece's estimate with a measured figure.

Five: the gate has already been shut once on AWS, by a government directive rather than a leak, within three days

When a mechanism like this fails, intuition goes to leaks. The failure that has actually happened was not one.

On June 9, 2026 Anthropic's Fable 5 and Mythos 5 went live on AWS. On June 12, the same announcement gained one line of update:

"To support compliance with the US Government export control directive, Anthropic has asked AWS to revoke access to Claude Fable 5 and Claude Mythos 5 for all users. All other models, including Opus4.8, are not affected"

Three days after launch, full revocation. This went beyond trimming a list. Both models disappeared for every user on AWS at once. The notice does not say whether other channels were affected.

That reorders what a buyer has to worry about. For a defence chain that includes a gated model from a programme like Fairwind, the commonly discussed risks are a leaked list and a rejected application. The failure that has actually been observed is a third one: the vendor shutting the entire SKU off within three days, under a government directive. And the only revocation observed so far hit the company that moved first.

That is also a real-world test of the argument Hugging Face CEO Clément Delangue made in July. Delangue wrote: "The cybersecurity debate on open-source AI is backwards. Open models aren't the risk, they're the defense! Attackers can already jailbreak any API or guardrails. Defenders can't secure systems with black boxes they can't control, inspect, test, or run locally." At the time the line could be read as a statement of position by the head of an open-source company, and Delangue does hold that position. The June revocation showed the point in practice: a component that cannot be run locally can be removed from a defence chain within three days, and the party removing it is neither the defender nor the defender's vendor.

The same mechanism ran for twenty years, and the record is public

There is a longer control group, and it is the security industry's own history.

Cobalt Strike is a red-team and penetration-testing toolkit, launched in 2012, sold commercially, and now owned by Fortra. Its distribution mechanism is almost exactly what the three frontier labs are doing now, and stricter on every count: US$3,500 per user per year (it has a price), vendor verification before purchase, usage restrictions and export-control terms in the contract, and a unique identifying watermark embedded in every licensed copy.

The result is on the public record. Cracked and trial copies reached state-level groups including APT41, Mustang Panda, OceanLotus and FIN7, and ransomware crews including Conti and Ryuk. Cobalt Strike became one of the most common command-and-control frameworks seen in real intrusions.

What turned the situation around was not the vetting mechanism. The vetting was there throughout; it was the thing that failed. The turn came from a court order in the Eastern District of New York on March 31, 2023. Microsoft, Fortra and Health-ISAC sued over licence breaches and intellectual-property infringement, seized more than 200 malicious domains and issued takedown notices for more than 1,900 IP addresses. Fortra, itself a party to the suit, later said malicious use fell by 80% over the following two years. That figure is the company's own and gives no metric or baseline.

This control group has to be used with care, because it has a real boundary. Cobalt Strike is software where the customer receives a copy; a gated model is an API, and an API cannot be cracked. So this history does not apply to the API path. It applies only to the path where a downloadable artefact exists, which means open weights and distillation.

And precisely because the boundary falls there, the history points at something harder. The path that rescued Cobalt Strike worked because the thing could be identified in the wild: a watermark on the executable, command-and-control domains that could be seized, and a licence contract to take to court.

An open-weight model has none of the three. The weights are public, so there is no licence to breach. It runs on someone else's hardware, so there is no domain to seize. And none of the three companies has disclosed any mechanism for tracing the output of their security models.

The accurate conclusion from this history: this mechanism ran for twenty years on a comparable product, it did fail, and the path that rescued it then is closed for open-weight models.

Six: our call, what it changes, and what would prove it wrong

Our call

The gate's lifespan is not set by the gate. How strictly the list is vetted and how high the approval rate runs decide who the gate stops; what decides how long the gate stays meaningful is the arrival time of the alternative path outside it. That path is open-weight models, which run on anyone's own hardware, beyond any list. The UK's AI Security Institute measures that path on a schedule. Its latest figures put open-weight models 4 to 7 months behind the closed cyber frontier, and the gap is shrinking. More pressing still, the gap is not one number but two, with narrow vulnerability work catching up fast and long-horizon multi-step operations catching up slowly, and every score the three companies cite in the gate's defence sits on the fast axis. Every future claim that some capability has been "brought under control" can be tested against that dividing line: first ask which axis the capability belongs to, then ask how far the outside path has come on that axis.

What this changes for security leaders

Three things, in order of priority:

1. Programmes like Fairwind and Trusted Access are a supply that can be cut, not a procurement item with a delivery date. The observed failure has nothing to do with a rejected application; what actually happened was an entire SKU vanishing for every AWS user in three days. The question for the vendor is therefore not how long approval takes, but which parts of a defence chain stop if the model is unavailable tomorrow.

2. The real price of each model is in its terms, not its price list. The only instance with public terms so far (Anthropic on AWS) requires opting into data sharing and accepting thirty-day retention of inputs and outputs plus human review. For a company sending customer data or internal code into the model, that is a legal matter, not a pricing one. Fairwind's equivalent terms have not been published.

3. The two capability axes lead to different roadmaps. For reproducing known vulnerabilities reliably and patching them, which is what the three companies' scores actually cover, open-weight alternatives close in within 4 to 7 months, and "wait for the gated model" and "wait for the alternative" become the same roadmap item. For long-horizon, multi-step attack-and-defence exercises, the alternatives take longer. No company has published a score for the gated models on that axis.

What this changes for the people writing the rules

Three independent implementations now exist as a control group, and all three are missing the same column: approval rate. The recommendation here is not to demand that column. None of the three has a motive to hand it over, and a handed-over figure would not necessarily be credible.

The stronger lever is a measurement that needs no one's voluntary cooperation: run the AISI and CAISI method once against the three specialised models. That requires only existing open-weight models and the benchmarks the three companies have already published. It answers two questions at once: how many months specialisation is worth, and how much lifespan the gate has left. Every public gap measurement so far compares general-purpose models, which is the wrong population for this debate.

What would prove this wrong

• Any of the three publishes an approval rate. Above 90%, the gate is sales routing rather than control, and this piece's whole "lifespan" argument gets downgraded to "a mechanism that never engaged has no lifespan question". Significantly below 90%, with named rejections, is the first time the "control" reading would have empirical support.
• Any of the three moves its security model to a public list price within twelve months. Then the vetted list was a staged commercial launch, not a governance shift, and the piece's premise has to be rewritten.
• AISI or CAISI measures a gap for the specialised models significantly larger than 7 months. The date range moves later, the gate's lifespan lengthens, and section four's date range is void.
• Any open-weight model publicly reaches the mid-80s on CyberGym or a successor benchmark with the same scoring. All three gates lose their technical meaning at once, and this question is closed.
• Any of the three discloses an output-tracing mechanism (the equivalent of a watermark). Then section five's claim that the path which rescued Cobalt Strike is closed has to be re-examined; this is the part of the piece most likely to be overturned by a single fact.
• A second government-directed revocation. Revocation rises from a single event to a feature of the mechanism, and the main procurement risk shifts from "leak" to "supply cut".

Only the second condition has a time limit. Its twelve months is this publication's own observation window, counted from the date of this piece. The other conditions expire with AISI's measurement cadence and the three companies' own release cadence. The third condition is the only measurement this piece asks for, and no institution has committed to running it.

Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; we distinguish original documents from reporting and mark what we could not verify.