OpenAI's US$1 billion cyber subsidy runs for six months, but the clock on its vetted cyber models is not one date. Our call: a July UK-US assessment found an open-weight model can already attack weakly defended systems of the kind the subsidy names, once given a foothold

Key takeaways

On September 3, OpenAI announced Daybreak for Frontline Defenders: US$1 billion of subsidised access for water utilities, electric grids, state and local governments, community banks, nonprofits and open-source maintainers (OpenAI, 2026-09-03). Daybreak is the OpenAI programme that gives vetted defenders access to OpenAI's cyber models. The money is credit against OpenAI's own products, not cash. OpenAI has set a target of having it consumed within six months.

Two other readings sit beside that six months. Less than three weeks earlier, OpenAI president Greg Brockman wrote under his own name that open-weight models' cyber capability is "only a few months behind the frontier". In July, the UK AI Security Institute, the British government's AI evaluation body, measured open-weight models as trailing the closed frontier on cyber by 4 to 7 months, and closing. Together they look like a compelling story, with three readings that all come out at a few months. One of the three is money being spent, and spending is harder to discount than talk.

This piece's conclusion: the claim of three independent instruments fails, but the question behind it survives and points somewhere more pressing. The two OpenAI readings, Brockman's essay and the subsidy announcement, come from one company and one application portal, less than three weeks apart. The essay ends by telling readers to apply for the very product the subsidy pays for. More decisive still, the three share no unit. One is a month count converted from narrow-task evaluations. One is an adjective with no stated basis. One is a budget burn rate. Three numbers in three units that all happen to come out as "a few months" do not corroborate one another.

What stands, and what this piece argues should take over: "how long does this gate hold" has no single answer, because the answer depends on which adversary the defence faces. The joint UK-US government assessment of July 23 gave two readings at once. Against well-defended targets, the newest open-weight flagship scored zero on gaining code-execution control, where frontier models averaged 20 of 41 samples. Yet the same assessment's conclusion says that model can already autonomously attack small, weakly defended enterprise systems when directed to do so and given initial network access. It completed the full simulated attack in one of 10 attempts, at a budget of 100 million tokens per attempt. The organisations the US$1 billion names as recipients include water utilities, community banks and local governments. They match the kind of organisation that sentence describes. Nobody has measured their defences.

The route runs in six steps:

① Put each of the three readings back in its own unit and ask whether they can be added.

② Test the route "the vendor's money is the vendor's judgment". It holds up better than expected, and what holds it up is not the money.

③ Deal with the cheapest rebuttal, "six months is just a calendar", and show why it fails.

④ Switch routes: six months is not an expiry date but an onboarding schedule.

⑤ Our call: two capability axes, two expiry dates, and everyone's pricing rests on the shorter one.

⑥ Last, a number that strains the word "gate": the list now has 2,000 organisations on it.

What does this piece add to yesterday's daily brief on the same story? Three things, each checkable. First, the strongest point in yesterday's judgment was attacked, and it did not survive. Yesterday's brief said the three readings came from three different instruments and landed in one order of magnitude. It added that three independent instruments agreeing beat any single reading. The relationship between the two OpenAI documents was then checked. Brockman's call to action reads, word for word, "Apply for Trusted Access for Cyber and get your team approved to use GPT-Daybreak-Blue". Less than three weeks later, the US$1 billion subsidised that same Daybreak. Both come from one company and point to one portal, so they are two steps of one campaign rather than two independent instruments. Second, the number that never had a denominator now has one, and the denominator cuts both ways. The usual consumption window for AI credit programmes is twelve months, so six is indeed half. But those twelve months are expiry terms, a limit on the recipient: use it or lose it. OpenAI's six is a consumption target, the grantor's own plan. They are different kinds of thing and cannot be compared head-on. Third, what would prove this piece wrong now carries a date. For weakly defended organisations, the gate did not have six months left. It stopped holding on July 23. That day, two governments jointly concluded that a downloadable open-weight model can already autonomously attack "small, weakly defended and vulnerable enterprise systems". The finding holds when the model is directed to do so and given initial network access. If a follow-up assessment on the same method withdraws that sentence, or someone measures these organisations' defences above that line, this piece's section on it is void.

The line in the tree is about a control surface changing address. Before 2026, a frontier lab's answer to "this capability will be used by the wrong people" was to train refusals into the model. From April, three labs switched to building a separate unrestricted version and handing it only to people on a list. Four competing readings hang on that line. This piece tests each against the new evidence and rewrites one of them at the end.

One: three numbers, three units, and they cannot be added

The table below lays out the three readings. The important difference between them is what each was measured with.

All three can be spoken as "a few months". The shared phrasing does not mean they measured the same thing.

The first is a time lag. Take open-weight models' scores, map them back onto the release timeline of closed models, and ask which month's frontier they match. Its denominator is a named set of evaluations.

The third is a burn rate. US$1 billion over six months comes to roughly US$167 million of credit a month to be used up (our calculation). Its denominator is OpenAI's product pricing and these recipients' usage. The burn rate measures no model's capability at all.

This is close to a truism. It still removes exactly what gave yesterday's judgment its force. "Three independent instruments agreeing" beats a single reading only because the instruments measure the same thing and so check one another. A thermometer and a bathroom scale giving two numbers at once are not two instruments agreeing.

The second reading is weaker still. It barely qualifies for the table. "Only a few months behind the frontier" names no model and no evaluation (Greg Brockman, 2026-08-16). And three weeks before Brockman wrote it, the UK and US governments had jointly published an assessment of the newest open-weight flagship of the time, with a conclusion pointing the other way. That assessment comes later in this piece.

And the second and third readings are not independent

This is the most substantive correction this piece makes to yesterday's judgment.

The call to action in Brockman's essay "The Defender's Window" reads:

"Apply for Trusted Access for Cyber and get your team approved to use GPT-Daybreak-Blue for authorized defensive work, including incident response, detection engineering, and malware analysis."

And:

"Time is of the essence, and defenders will need to pursue the steps below at turbo speed."

Less than three weeks later, the same company put US$1 billion of subsidised credit behind the same Daybreak, targeted to be used up in six months.

So readings ② and ③ relate like this. An essay says time is short, apply for Daybreak. Less than three weeks later the company puts up US$1 billion so that applying for Daybreak costs nothing, and aims for the money to be used within six months. That is two steps of one campaign, not two instruments.

Brockman's essay contains no mention of a subsidy, credits or any dollar amount; every section was checked for one. So the two documents are not one press release split in half. But "not the same document" and "two independent instruments" are far apart. Independence requires more than non-overlapping text. It requires that author, purpose and interests are not shared. These two documents share an author company, and both point at one application portal.

This correction takes away the core of yesterday's judgment's force. What remains is one outside yardstick, plus one company saying the same thing in two registers. That is still information. But it is "one reading plus one claim", not "three readings converging".

Two: route one, the vendor's money is the vendor's judgment

What is being claimed. This is the route yesterday's judgment bet on. Claims can be discounted; spending is hard to discount. A subsidy set to be used up in six months amounts to the company pricing, internally and through a finance process, how long the urgency lasts.

Who's betting on the claim. Yesterday's judgment on this site. The route has a respectable pedigree in business analysis: it is revealed preference, which ignores what a company says and looks at where it puts its money.

How hard the evidence is. When yesterday's brief recorded them, the route's two load-bearing facts had a single source: Help Net Security, which quoted the official announcement sentence by sentence. The openai.com page returned HTTP 403 on the fetch path used here, so the direct check failed. Yesterday's brief wrote that down as its own fourth overturn condition: if those two facts were a relay error, the whole item collapses.

This round's handling. The direct check was retried. On that fetch path openai.com still returned 403; that is a long-standing access limit on this fetch path, not a new one. But both facts now have independent second and third channels. Help Net Security reports (Help Net Security, 2026-09-04):

"The billion is credit against OpenAI's own products, and the company is targeting it to be consumed over the next six months."

SecurityWeek, in a wholly separate piece, writes of "the subsidized six months" (SecurityWeek, 2026-09-04). The Register and TechRadar each ran the story under a US$1 billion in AI credits headline.

So this item holds, and its footing is now firmer. "Six months" and "credit, not cash" went from a single source to agreement across channels. The most fragile item in yesterday's brief has been shored up.

What would prove this wrong. OpenAI publishes post-subsidy pricing for these recipients, and it is a permanent discounted rate. Then the money is not pricing scarcity; it is the first six months of a long-term programme.

Three: route two, six months is just a calendar

What is being claimed. The cheapest rebuttal, and the first one to rule out. On this route, six months is nobody's judgment about a threat. It is a fiscal year, a grant period, or the by-product of some administrative cycle unrelated to capability diffusion. If so, the third reading is not revealed preference but a calendar, and the strongest point in yesterday's brief collapses outright.

Who's betting on the claim. Yesterday's brief listed it as its own third overturn condition, and wrote that this item was entirely unchecked and the most fragile part of the judgment.

How hard the evidence is. It was checked this round, and the route fails, for two reasons.

First, the date matches no obvious administrative boundary. Six months from September 3, 2026 lands in March 2027. That is not the end of a calendar year, and not the usual US federal fiscal-year boundary of October 1. (An arithmetic correction in passing: yesterday's second overturn condition put six months out at "about 2026-03". It should read 2027-03.)

Second, and harder: the person who set the clock said in public what it is hung on, and it is not a calendar. Brockman's essay ties the urgency to a dated release:

"The most recent of these models appears slated to be released at the end of August, and seems likely to significantly accelerate the threat landscape."

Commentators on the essay read it the same way. 7AI, a security startup, wrote on August 18 about Brockman's framing and spelled out where the clock hangs (7AI, 2026-08-18):

"Capable open weight models are months from being in everyone's hands, starting with a release at the end of August."

So the people involved in this story, operator and commentators alike, tie the window's length to a named, dated outside event: an open-weight release at the end of August. That is a judgment about capability diffusion, not a calendar.

And the release did happen. GLM-5.3, an open-weight model from the Chinese lab Zhipu, posted its weights on Hugging Face on August 28.

So this route can be closed, and closing it supports route one: the six months looks more like a response to an outside event than an accounting by-product. The most fragile item in yesterday's judgment did not just survive this round; it moved in the judgment's favour.

(What was shown is that no calendar explanation turned up and a non-calendar one did. That is not proof a calendar explanation is impossible; an unnamed administrative cycle cannot be ruled out in principle. This route is therefore heavily discounted but not eliminated.)

Four: route three, six months is not an expiry date but an onboarding schedule

What is being claimed. Six months is a judgment, but not about how long the gate holds. It is about how fast to bring these organisations on board. The route accepts the money as revealed preference, and argues that what it reveals is sales velocity, not the speed of capability diffusion.

Who's betting on the claim. This piece adds the route. Yesterday's judgment did not cover it.

How hard the evidence is. Medium. The evidence came out of homework this piece meant to use for something else: setting "six months" next to its peers.

The standard windows for AI and cloud credit programmes were checked. The industry norm is twelve months. AWS Activate's Founders credits run about twelve months and its Portfolio credits about twelve to twenty-four. Google for Startups cloud credits expire after a year. Purchased Anthropic credits expire a year from purchase. Nonprofit and research credits run a year. So six months really is half the norm. That gives yesterday's judgment a denominator it never had, and the direction supports "this window is unusually short".

But set side by side, the two turn out not to be the same kind of thing, and that is this route's way in.

Those twelve months are all expiry terms: a limit the grantor sets on the recipient, use it or lose it. They bind the recipient.

OpenAI's six is not that. The words are "the company is targeting it to be consumed over the next six months": a consumption target OpenAI set for OpenAI. It describes how fast the grantor wants the money used. A use-it-or-lose-it deadline and a plan to have the money used within six months point in opposite directions. The first is a restriction. The second is a business objective.

When a company wants a subsidy used up fast, the most natural explanation is not "the capability will stop being scarce in six months". It is "these organisations should have their workflows integrated within six months". The recipients are water and wastewater systems, electric grids, state and local governments, community banks, nonprofits, open-source maintainers. Once their switching costs are sunk, these organisations almost never pull back out.

Lock-in works through switching costs. A customer that has sunk its data, processes and system integration into a product finds leaving expensive, and stays even when the price rises. On this reading, the US$1 billion buys six months of integration time.

This route and route one are not mutually exclusive, and that matters; it should not be read as "so it was never an urgency judgment". Both can hold at once: precisely because the capability's scarcity is judged to have only months left, the recipients have to be wired in while it lasts. But the two predict different things for month seven, and the predictions can be told apart:

• If the six months is an urgency judgment, month seven is about capability: whether the path outside the gate has arrived.
• If the six months is an onboarding schedule, month seven is about the invoice: the workflows are integrated, and the first full price quote arrives.

Post-subsidy pricing has no public answer yet, and the gap lies in the announcement, not in the checking. SecurityWeek independently pointed at the same blank and gave its readers the same prescription:

"the announcement gives no indication of actual costs"

"be sure you understand the full cost and range after any subsidy before you commit"

One entry belongs here against this site's own record. Yesterday's judgment said post-subsidy pricing appeared nowhere in the official announcement or the three relaying channels, and counted "month seven" as its own contribution. The blank is real, and a fourth channel now confirms it. But this site was not the only one to spot the blank. A security news outlet wrote it up the same day, as purchasing advice to its readers.

This is the third error of the same shape on this story. Yesterday's judgment was itself written to correct an older one that said "no one is currently measuring this gap" (three parties were, one of them the gate's own operator). On the day of that correction, it wrote "none of the three sources mention it". The rule that follows can be run: any sentence of the form "no one has noticed / no one is measuring" gets a counter-search against this site's own archive and at least one outside channel before it is written. Such a sentence's value comes entirely from being true, and if it is false the cost is the whole argument built on it.

What would prove this wrong. OpenAI publishes post-subsidy pricing that is a permanent discounted rate for these recipients; then the integration reading loses its revenue model. Or, six months on, renewal among the subsidised organisations is very low, which would mean the integration did not take.

Five: our call. The gate guards two capabilities, and their expiry dates are an order of magnitude apart

Now the question this piece argues should take over.

The three routes above all argue over what "six months" means. They share one unexamined premise: that the arrival time of the path outside the gate is a single number.

The arrival time is not a single number, and the institute that says so is the one that produced reading ①.

On July 23, 2026, the UK AI Security Institute and the US Center for AI Standards and Innovation, the AI evaluation centre at NIST, jointly published a preliminary assessment of Kimi K3's cyber capabilities (UK AISI and US CAISI, 2026-07-23). Kimi K3, from the Chinese lab Moonshot AI, was then the newest open-weight flagship. The assessment's headline conclusion:

"Kimi K3 performs significantly below the most recent frontier cyber-capable models on preliminary cyber evaluations."

Taking the numbers apart shows the shape of the gap, and the shape matters more than the numbers.

Against other open-weight models, Kimi K3 is an advance. On ExploitBench, an exploit-writing test the assessment ran:

"Kimi K3 achieves a score of 32%, whereas GLM-5.2 achieves a score of 24%"

Against the frontier, what shows up is not a percentage gap but a categorical miss:

"Kimi K3 failed to develop exploits that achieved arbitrary code execution (ACE)"

The same assessment gives the comparison:

"the most cyber-capable models achieved ACE on 20/41 samples on average"

The term needs setting out, because it is the hinge of this section. Arbitrary code execution means an attacker can make the target machine run a program of the attacker's choosing. It is the door between "there is a weakness here" and "this machine is under my control". Finding a vulnerability is not the same as exploiting it. Exploiting it reliably is the capability a gate exists to manage.

On that item the newest open-weight flagship scored zero, while frontier models averaged 20 of 41 samples. The long-horizon axis reads the same way. On a 32-step attack path:

"Kimi K3 reached step 17 of this 32-step attack path on average, while the most cyber-capable U.S. models reached 28.5 steps on average"

Up to this point, the story reads "on the broad axis, open weights are still far behind". One more sentence in the assessment overturns it.

The same assessment says which targets Kimi K3 can already break into

On the same 32-step path, beyond the average step count, the assessors recorded another reading. The Last Ones is the name of the simulated corporate network that path runs through:

"In one of the 10 attempts, Kimi K3 successfully completes 'The Last Ones' cyber range within the 100M token limit."

One full run in ten. And the conclusion the assessors drew from it, word for word:

"Kimi K3 is capable of autonomously attacking small, weakly defended and vulnerable enterprise systems, when directed to do so and given initial network access."

The speakers are two governments' evaluation bodies. The date is July 23. The subject is a model anyone can download and run in their own server room. The object is "small, weakly defended and vulnerable enterprise systems".

So the right reading of the broad axis is not "the threshold hasn't been crossed". The axis has two thresholds, and Kimi K3 has already crossed the lower one.

• Against well-defended targets (frontier-grade attack and defence, reliable code-execution control across 41 samples, the full attack chain): open weights are far behind. Zero against twenty; 17 steps against 28.5.
• Against small, weakly defended organisations: two governments have concluded the model can do it now, on the conditions that someone directs it and gives it an initial foothold on the network.

(A boundary that has to travel with this. The one-in-ten came under an inference budget of 100 million tokens per attempt, and the assessment states that all its readings hold at the stated budget. Most operators would not spend that much. But "most would not" and "cannot" are different things, and the budget is the part that gets cheaper.)

This is the call this piece makes, and where it rewrites the tree above.

The three readings looked convergent because all three sat on one axis and asked a question with no recipient in it. AISI's 4 to 7 months is converted from 70 narrow capability evaluations. Brockman's "a few months" has no stated basis, and it came three weeks after the two governments' assessment without citing it. The six-month subsidy pays for the two Daybreak tiers: Daybreak Blue, which runs common defensive work on OpenAI's mainline models, and Daybreak Red, which gives approved organisations OpenAI's specialised cyber models. The evaluations the three frontier labs cite to vouch for products of this kind (CyberGym, CWE-Bench, internal vulnerability-discovery rates) all sit on the narrow axis. This site's piece two days ago took them apart.

So "how long does this gate hold" has no single answer, because the answer depends on who is asking. Side by side, two lists overlap.

The subsidy's named priority recipients, in OpenAI's words, are "water and wastewater systems and electric grid operators, alongside state and local governments, community and regional banks, nonprofits, open-source maintainers". The targets the two governments concluded an open-weight model can already attack on its own are, in the assessment's words, "small, weakly defended and vulnerable enterprise systems".

The two lists describe the same organisations.

The month-seven question then changes. It is no longer mainly "what does the credit cost once the subsidy ends". It is this: for the organisations taking the subsidy, the scarcity of attacker capability implied by Brockman's "window" framing had already eroded when the subsidy began. By the two governments' assessment of July 23, that scarcity ended for weakly defended organisations six weeks before the subsidy was announced.

That does not make the US$1 billion worthless. Defenders getting better tools is still defenders getting better tools. What it means is that what the money buys has been described wrongly. For these recipients, the window in which attackers cannot yet catch up has already closed. What the money buys is time to close a defensive gap. That should be judged by whether these organisations' detection and patch times move within six months, not by how many months the gate has left.

And none of the three frontier labs has published a broad-axis score for its cyber model, or split its readings by the grade of adversary the defence faces.

Six: with 2,000 organisations on the list, does the word "gate" still fit

Last, a number that is new this round and tightens the whole vocabulary above.

The same announcement carries a sentence that was not on the tree before:

"Thousands of defenders across 2,000 approved organizations and workspaces already use Daybreak, including cybersecurity companies, defense organizations, and law enforcement organizations."

The sentence cuts two ways.

First, it reverses an observation this site made two days ago. The piece two days ago measured disclosure at the three labs falling in one direction over time. Anthropic in April disclosed about 50 organisations and five named members. OpenAI in June disclosed seven countries but no organisation count. Google in September gave only a programme name. Now OpenAI has given a number, and it is the largest of the three. The one-directional decline no longer holds.

Second, and more important: 2,000 is a different kind of thing from 50. An invitation list of fifty allocates scarcity. A list of 2,000, open to applications, with US$1 billion of subsidy pushing people onto it, looks more like a sales channel.

The number's limits need stating, because it is easy to overuse. The 2,000 counts approved organisations and workspaces across Daybreak as a whole, security companies, defence and law enforcement included; it is not the number of subsidy recipients. And it is a numerator, not a rate. With no application count, there is still no approval rate, and on that figure all three labs still disclose nothing. SecurityWeek also notes, independently, that the announcement "goes into few specific details".

Even read only as a numerator, it changes the question. The operator of a gate is spending US$1 billion, at about US$167 million a month, to push more people through that gate. An operator protecting scarcity would not behave this way. The spending has the shape of a land grab: building the installed base before the alternative path arrives.

So this piece's handling of the tree's dispute over "is this control or sales routing" is: possibly both, in that order — control first, then channel. No measurement yet supports that sentence. It is a working read this piece puts forward, not a call. What would settle it is the approval rate, which none of the three labs discloses.

Seven: the question to ask instead

Our call

"How long does this vetted-list cyber gate hold" is the wrong question, because it assumes one expiry date for everyone. The two governments' joint assessment of July 23 gave results split by how well the target is defended, not a single date. Against well-defended targets, open weights are far behind: code-execution control on zero of 41 samples against the frontier's 20 of 41, and an average of 17 steps on a 32-step attack path against 28.5. Against small, weakly defended organisations, the same assessment says Kimi K3, an open-weight model, can already attack them autonomously when directed to and given initial network access. It did so in one of 10 attempts. So the useful question is whom the gate has already stopped guarding. The three expiry estimates in circulation all leave out whom they apply to, and they do not corroborate one another: they share no unit, and two of them come from one company and one application portal, less than three weeks apart. Every later claim that "this capability is still controlled" can be tested on the same line: first, controlled against whom; then, whether anyone has measured it split that way.

What this changes, and for whom

Organisations applying for the subsidy. Three things, in order of priority:

1. The question that matters is what an adversary at the organisation's own grade can get today, not how many months the gate has left. For water utilities, community banks and local governments, two governments concluded in July that a downloadable model can autonomously attack targets of that grade when directed to and given initial network access. A security plan that still assumes attackers lack frontier capability has already lost that assumption; it does not wait for a six-month review. That changes the order of work. Network segmentation, closing off initial footholds and shorter detection and patch times help whatever the adversary's strength. They rank ahead of waiting for a better model.

2. The month-seven price is not in writing. The announcement omits it, and so do the three channels that relayed it. SecurityWeek advises its readers to establish the full post-subsidy cost before committing. The concrete open questions are the rate these recipients pay after the subsidy for the same usage at the same tier, with Blue and Red quoted separately, and whether that rate has an end date.

3. A gated cyber model is a supply that can be cut, not a procurement line item. The failure already observed in gated cyber models is not a leaked list. On June 12, 2026, three days after launch, Anthropic's Fable 5 and Mythos 5 were withdrawn for all users under an export-control directive (Anthropic, 2026-06-12). The question that matters is not how long approval takes, but what in the defence chain stops if the model is unavailable tomorrow.

Rule-making in this area. The lever this site's piece two days ago proposed still stands and has not been pulled: run the existing AISI and CAISI method once against the three labs' dedicated cyber models, because every public gap reading compares general-purpose models.

What this piece adds is the cheaper half. The Kimi K3 assessment has already shown the right shape: report by axis, and report whether a threshold was crossed, not just a percentage. "Zero ACE against an average of 20 of 41" carries far more information than any converted month count. A follow-up gap measurement that publishes only a composite month figure would hide again the split this piece points to.

What would prove this wrong

• AISI, CAISI or a follow-up assessment on the same method withdraws the finding "capable of autonomously attacking weakly defended systems", or narrows its conditions so they no longer cover these subsidy recipients. This piece's most load-bearing sentence goes, and the whole argument that the recipients' scarcity window is already over is void. The piece rests most heavily on this one finding.
• Someone measures these organisations (water utilities, community banks, local governments) as clearly better defended than the assessment's "weakly defended" line. This piece reads the two lists as the same organisations because the two descriptions overlap, not because anyone has actually measured these organisations' defences. This is the piece's softest seam.
• Any open-weight model achieves non-zero code-execution control on a same-method assessment, or reliably completes the 32-step path. Then even the half "still far behind against well-defended targets" falls, and the two thresholds merge into one.
• Any of the three labs publishes a long-horizon or end-to-end score for its dedicated cyber model. The sentence "no lab vouches for these products on the broad axis" fails at once, and that would be good news.
• OpenAI publishes post-subsidy pricing that is a permanent discounted rate for these recipients. Section four's onboarding-schedule reading loses its revenue model, and the second point for subsidy applicants drops to a routine procurement question.
• Brockman's "a few months" turns out to rest on a named measure, and that measure covers the broad axis. Then reading ② is promoted from an adjective to a measurement, and section one's "cannot be added" needs rewriting.
• Any of the three labs publishes an approval rate. Above 90%, section six's "control first, then channel" working read gains support. Well below 90%, with named rejections, the "control" reading would have empirical backing for the first time.

This piece sets no time window of its own for the conditions above; they come due on the measurement cadence of AISI and CAISI and the release cadence of the three labs. The one observation window this publication sets is the subsidy itself: six months from 2026-09-03, around 2027-03-03, two things are due for checking — whether post-subsidy pricing has been published, and how many subsidised organisations kept using the service. That date is this publication's own observation window, not a deadline any party has committed to.

Which branch this piece updates. Path D, the capability-gap by-product reading, said the list's lifespan is set by how long outside capability takes to catch up, and that a third-party government agency measures that gap and finds it closing. This piece replaces "that gap" with results split by how well the target is defended. Against well-defended targets, open weights are still far behind: code-execution control on zero of 41 samples against 20 of 41, and 17 steps against 28.5. Against small, weakly defended organisations, two governments concluded the capability has already arrived. The call therefore changes from "one closing gap" to "this gate has different expiry dates for different targets, and the segment that has already expired is exactly the group the subsidy names".

Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; we distinguish original documents from reporting and mark what we could not verify.