Who gets new AI models first: labs pick, Washington clears

Key takeaways

AI labs, the companies building the models, let a list of "trusted partners" use each new model for a few weeks before anyone can buy it. On October 30, in a public-records lawsuit, the White House Office of the National Cyber Director (ONCD) filed a list of withheld documents. That list shows ONCD writing to the labs model by model, from late June to mid-September, naming the partners cleared for early access.

The first impression: the US government is quietly licensing AI.

Who now decides who gets those first weeks?

Our call: the labs nominate from their own customers, the government writes back with the names it has cleared, and outsiders cannot see the criteria. The letters are withheld, nothing public shows the government striking a name, and a White House official told CNBC the government does not approve company releases. Our read: early access will tend to go to customers the labs already value who can also pass US national-security review.

The weeks before a new model goes public are worth most when the model can find software flaws

The strongest AI models no longer reach everyone on release day. A list of partners gets them first, for a few weeks. Frontier models are each lab's newest and most capable generation. This report calls the stretch before public release, when only listed partners have the model, the "early-access window".

According to Stratechery, Anthropic launched Project Glasswing in April, giving its flaw-finding Mythos model first to about 50 organizations that maintain critical infrastructure.

Google's October 28 announcement of Gemini 4 Carbon set out the same order: a subset of cyber defenders first, then a gradual widening to trusted partners through the Fairwind Program, and only then general developers and businesses. Fairwind is Google's partner program for handing out its security models.

The window is valuable because a model that finds software flaws helps attack and defense alike. A defender who gets it first can patch its own systems while attackers may not yet have an equal tool. Whoever gets it late faces attackers who may already be using it.

Listed partners also act as testers. According to Fortune, Amazon researchers testing Fable 5, another Anthropic model, found in June that its safety guards could be bypassed. Amazon raised it with the US government, and within days the government ordered controls on the model. Anthropic said the bypass technique was not unique to Claude.

So who is on the list decides who patches first and whose reports go straight to the government, and the next question is who writes the list.

Since late June, the early-access list has needed US government clearance, model by model

The labs used to set the early-access list themselves; since late June each model's list goes to the US government for clearance. Export controls are the Commerce Department's legal tool for keeping sensitive technology from going abroad. On June 12, Commerce wrote to Anthropic barring any foreign national from using Fable 5 and Mythos 5. Anthropic said it had no technical way to block only foreigners, so it switched both models off for every user worldwide. The controls were lifted on June 30, and both models returned on July 1.

On June 26, Commerce Secretary Howard Lutnick sent a second letter. According to CNBC, it allowed about 100 companies and federal agencies, called "trusted partners" in the letter, to use Mythos 5. The same day, OpenAI previewed GPT-5.6 on its official blog: "At their request, we are starting with a limited preview for a small group of trusted partners whose participation has been shared with the government."

The two agencies do different jobs. Commerce approved those 100 or so users with its export-control power. ONCD receives the lists the labs send and answers each model with a letter.

The October 30 documents show how far this practice reaches. Protect Democracy, a US nonprofit legal organization, asked ONCD and other agencies for records under the Freedom of Information Act, got none, and sued. That law lets anyone request records from a federal agency, and an agency that refuses has to give reasons. An agency withholding records must file a list, called a Vaughn index, giving each document's date, subject and reason for withholding, so a court can test the reasons.

ONCD's index describes one batch of emails as "ONCD email to AI Lab identifying trusted partners cleared for pre-release access to an identified covered model." A covered model is one the government judges capable enough to go through this process. "Clearance" in this report comes from the word "cleared" in that description; no approval record has been made public. By our count there are 27 such ONCD emails, the first dated June 25 and the last September 17. The index also says where the lists come from: "Trusted Partners derived from confidential customer lists submitted to ONCD for national security purposes."

So the list now passes through the government, and the next question is by what rules.

The clearance rules sit in withheld documents, and companies off the list have no public way to apply

The clearance criteria are not public, and a company off the list has no public channel to apply. An executive order is a directive by which the president instructs federal agencies without Congress. Executive Order 14409, signed on June 2, states only principles: labs may choose, together with the federal government, the trusted partners that get early use of covered models. The same order says: "Nothing in this section shall be construed to authorize the creation of a mandatory governmental licensing, preclearance."

The details sit in a separate document called the "Voluntary AI Framework". The index shows it is a seven-page Word file dated July 31, more than a month after the first clearance email. On October 30 the agencies withheld all 60 pages of the records.

One reason the agencies give for withholding the lists is that the customers' identities are information the labs have always protected as trade secrets. That is the agencies' position, and the plaintiff can challenge it in court. Meanwhile no outsider can see who is on a partner list, or on what basis.

The only entry point the public record shows is a lab writing a company into the customer list it sends to ONCD. The framework's full text is withheld, so whether it describes any other way to apply cannot be known from outside.

So both gates are now in place, and both are hidden.

Two hidden gates now stand before early access, so places will drift toward the labs' most valued customers

Our inference: early access to a new frontier model now passes two gates. First, a lab decides whether to put a company on the customer list it reports. Then the government clears the list, model by model. Outsiders can see neither gate's criteria, so early-access places will tend to concentrate among customers the labs already value most who can also pass US national-security review. The partner list is drawn from the lab's customer list, so a lab naturally puts its most valued customers on it first. The government collects the list for national-security purposes, so its test is national security.

The inference rests on two premises. The step on government clearance gives the first: partner lists come from the labs' customer lists, and the government clears them by letter, model by model. The step on hidden rules gives the second: the clearance rules are not public, the agencies withhold the customer lists as trade secrets, and companies off the list have no public way to apply. Without the first premise, early access would still be a lab's commercial decision, and a customer could negotiate with the lab. Without the second, companies off the list could apply under public criteria and would learn why they were refused. The second premise is backed by the text of the withholding reasons. No document says directly that places will concentrate among big customers; that step is this report's inference.

The weakest link is the first premise: has the government's gate ever stopped anyone? The index proves only that the letters exist; it records no approval and no refusal. Both premises could hold and the inference still fail. That would happen if the labs listed every customer that pays and asks, and the government never cut a name. Both gates would then be formalities, and early-access places would be no more concentrated than before.

So if the inference holds, some companies gain and others lose.

One level up: getting a new model early now depends on being a valued lab customer that can pass US national-security review

Our read: the companies and agencies best placed are those already key customers of a lab and in close dealings with the US government. Companies outside the labs' key accounts will find it harder to get into the window; no case of a company being shut out has been made public. Makers of security products feel it first. Listed vendors can build a new model into their products before it goes public, while rivals off the list can follow only after release, and that lag now sits inside their product plans.

What to watch next

First, whether Protect Democracy challenges the Vaughn index in court. If a judge orders a page-by-page review or partial release, the lists and the framework could come out for the first time. Second, whether Google says, when it widens Gemini 4 Carbon from defenders to Fairwind partners, that the list was cleared by the US government. Third, whether the next frontier model's announcement says it goes to trusted partners first, for how many weeks and to how many organizations, compared with the wording for Gemini 4 Carbon and GPT-5.6.

What would prove this wrong:

The deadlines below are SecondSource's own.

• By March 31, 2027, documents released by court order or by the government show that ONCD's letters only received the labs' lists and never cut a single company: the "government clearance" step becomes "the government takes receipt", and the two gates in the main inference shrink to the lab's alone.
• By June 30, 2027, the White House or ONCD publishes eligibility criteria or an application channel for trusted partners: the step on hidden rules is wrong.
• By June 30, 2027, a US frontier lab openly lets customers use a new model before release outside the government list, and faces no export control or public demand to stop: the main inference is wrong.

The strongest counterargument this report found: a White House official told CNBC on July 17 that the government "doesn't provide approvals for AI releases from private companies" and that "decisions on timing and scope of releases rest entirely with the companies". If so, the government only receives lists the labs have already chosen, without reviewing them, and early access still depends on the labs alone. The same CNBC report cites two people familiar with the matter who say the White House is deciding which companies can use the newest models first.

Appendix

① Numbers and statements in the main line, row by row

② Statements and terms

• The "early-access window" in this report means the stretch before a new model's public release when only listed partners can use it. Access after public release, when companies off the list can also buy the model, is outside this report.
• "Trusted partners" is the term shared by the executive order and the labs' and agencies' documents. It is not this report's own category.
• Some outlets (heise on October 31, for example) wrote that the ONCD and Commerce emails to the labs had been released. ONCD's letter states that all 60 pages, 30 records, were withheld in full; what is public is only each entry's date, subject and one-line description in the index. This report follows the letter.
• "Vaughn index" is the name US courts use for a withholding list, after the 1973 case Vaughn v. Rosen.
• Why would labs go along with a process that is voluntary in name? Our read: in June the Commerce Department showed that one letter can pull a model offline worldwide. For a lab that wants to release on schedule, handing over a list and waiting for the government's reply costs less than being controlled again. Staged release is not purely forced by regulation: Anthropic already gave listed partners first use when it launched Glasswing in April.
• Besides trade secrets, the withholding grounds include national security and the president's internal communications.
• According to anonymous sources cited by Axios in August, the White House does not plan to publish the framework, and the details go only to companies in the process.
• Miles Brundage, formerly head of policy research at OpenAI, criticized such rules on X in July: they need not be written down like regulations, which widens the room for poorly vetted rules and for corruption. This was a short comment on a news link, not a worked argument.
• SecondSource's September 4 deep dive covered three labs switching to list-based release of security models. What this report adds is the US government layer that the lists now pass through.

Where this sits on this publication's map: what this report adds is who sets the early-access list. That used to be the labs alone; since late June there is also a layer of US government letters, model by model. No public record yet shows the government striking any company from a list.

Sources

• ONCD, production letter and Vaughn index, Protect Democracy Project v. ONCD et al., Civil Action No. 26-3064, 2026-10-30
• The White House, Executive Order 14409, Promoting Advanced Artificial Intelligence Innovation and Security, 2026-06-02
• Anthropic, announcement on access to Fable 5 and Mythos 5, 2026-06-13
• Anthropic on X, announcement that the export controls were lifted, 2026-06-30
• OpenAI, Previewing GPT-5.6 Sol, 2026-06-26
• Google, Introducing Gemini 4 Carbon, 2026-10-28
• Google DeepMind, Fairwind Program, 2026-09-02
• CNBC, Trump admin allows Anthropic to release Mythos AI model to some companies, government agencies, 2026-06-26
• CNBC, The White House is dictating access to frontier AI models, 2026-07-17
• Mayer Brown (republished by Mondaq), Commerce Department Extends Export Controls To Advanced AI Models
• Fortune, How a warning from Amazon led the White House to shut down Anthropic's Mythos model, 2026-06-14
• Axios, White House AI framework under wraps, 2026-08-04
• Politico, White House asks OpenAI and Anthropic to hold new models from UK testers until U.S. review, 2026-09-24
• Stratechery, Anthropic's New Model, the Mythos Wolf, Glasswing, and Alignment, 2026-04
• Miles Brundage on X, 2026-07-17

Written from the same research and judgments as the Traditional Chinese edition. Sources are linked; original documents are kept apart from reporting, and what could not be verified is marked.