Gated Is Now the Default for Cyber Models. The Gap Is Not.

On 5 November 2026, OpenAI released GPT-6 Cyber, a model built for authorized vulnerability discovery, exploit development and web penetration testing. OpenAI's system card designates it Critical in Cybersecurity under the company's Preparedness Framework and restricts it to approved users and organizations in a vetted programme called Daybreak Red. Eight days earlier, on 28 October 2026, Google announced Gemini 4 Carbon and said it would go first to a subset of cyber defenders, then to additional trusted partners through its Fairwind Program, with no date for general release. Anthropic has gated its Mythos line since 7 April 2026, first through Project Glasswing and, since 6 October 2026, through a three-tier Cyber Verification Program.

Three of the leading frontier labs now handle their most cyber-capable models the same way: vetted defenders first, everyone else later or behind safeguards. Restricted release has stopped being one company's judgement call and become the working default for this class of model.

That is a real change, and it is worth being exact about what it changes. Gating governs who receives discovery capability first and on what conditions. It does not govern whether discovery outpaces remediation, which is the question the Velocity Gap doctrine was written to answer.

Key Takeaways

• Three labs, one release pattern. OpenAI's GPT-6 Cyber (5 November 2026) is limited to approved Daybreak Red users. Google's Gemini 4 Carbon (28 October 2026) goes first to a subset of cyber defenders and then to Fairwind Program partners. Anthropic's Mythos models are available only through its verification programmes
• OpenAI rates GPT-6 Cyber Critical in Cybersecurity under its Preparedness Framework, the same designation as GPT-6 Astra, and wraps access in identity verification, use restrictions and IP allowlisting for the API
• "Trusted defender" is a category each provider defines for itself. Eligibility, verification depth and conditions differ across Daybreak, Fairwind and the Cyber Verification Program, and each provider can change them
• Gating is a head start, not a barrier. The UK AI Security Institute measured open-weight models 4 to 7 months behind closed frontier models on cyber in July 2026, down from 6 to 10 months through most of 2025
• Access produces findings, not fixes. Anthropic reports Glasswing partners found at least 129,000 verified vulnerabilities between April and July 2026. The binding constraint remains the pipeline that has to absorb them
• Three questions follow for every organization: access (who in your vendor and supplier chain is inside these programmes), absorption (can you take the findings), and exposure (what reaches adversaries regardless)

What Each Lab Has Actually Gated

The programmes share a shape and differ in detail, and the detail is where the diligence questions come from.

OpenAI. The GPT-6 Cyber system card, published 5 November 2026, describes "a cyber-specialized variant of GPT-6 Astra designed for authorized security work" and assigns it the same capability designations as Astra: Critical in Cybersecurity, High in the Biological and Chemical domain, and below High in AI Self-Improvement. Access runs through Daybreak Red. Organizations must use single sign-on, multi-factor authentication and least-privilege access; individuals pass identity and liveness checks and use a physical FIDO2 security key; API access requires IP allowlisting by default. Fortune reported that the model goes first to a small group of approved Daybreak Red customers and to all Daybreak Red customers over the following weeks, and that it is OpenAI's fourth cybersecurity-focused model of 2026 after releases in April, June and August. Daybreak Blue, the companion programme, covers defensive tasks such as code review, malware analysis and incident investigation. Separately, SecurityWeek reported that on 3 September 2026 OpenAI announced Daybreak for Frontline Defenders, a $1 billion commitment of subsidized access to its cyber capabilities, with training and technical assistance, for state and local governments, critical infrastructure operators, nonprofits and open-source maintainers.

Google. Google launched the Fairwind Program on 2 September 2026 as a limited-access programme for governments and trusted partners, with more than 650 participating partners and initial access staged across governments and national cyber authorities, critical infrastructure operators and core technology platforms. Participants agree to limit access to employees on internal cybersecurity, incident response or penetration testing teams. In a 13 October 2026 post, Google invited defenders to apply to Fairwind for a version of Gemini 4 Argon without cyber guardrails. Its 28 October 2026 announcement of Gemini 4 Carbon states that it "will make Carbon available to a subset of cyber defenders", phase in additional trusted partners through Fairwind, and reach developers, businesses and consumers after it has gathered feedback and refined guardrails. Google also says it is engaged in the US government's voluntary process for pre-release model testing, the kind of voluntary pre-release framework we described in our analysis of the June 2 executive order.

Anthropic. The pattern began here. On 7 April 2026 Anthropic disclosed Claude Mythos Preview and its decision not to make it generally available, routing it instead through Project Glasswing. On 6 October 2026 Anthropic folded Glasswing into an expanded Cyber Verification Program with three tiers: Defense Access for defensive work, open to organizations and to individual researchers; Red Team Access for authorized penetration testing and red teaming, for organizations only; and Specialized Access, with the fewest cyber blocks, for a limited set of organizations authorized to test safety-critical systems, each reviewed in depth in collaboration with the US government. Existing Glasswing members moved to Specialized Access. On 9 November 2026 Anthropic announced Claude Mythos 5.2, again available only to vetted organizations through its verification programmes.

One caution on the capability claims. Google reports that Carbon scores 54.8% on the ExploitGym benchmark; OpenAI's system card reports 48.45% for GPT-6 Cyber on the same benchmark. Both are vendor-reported results under each vendor's own test conditions. They establish that these models are strong at exploitation. They do not establish a ranking.

What Gating Does Buy

Three things, all of them real.

A head start for defenders. Vetted organizations run the capability against their own code before the same capability is broadly reachable. Anthropic reports that Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026, drawing on 33 partner reports. Those findings exist because access was granted early.

Conditions on use. Every programme attaches obligations: verified identity, named users, authentication standards, data retention so the provider can monitor for misuse, and limits on authorized activity. That is a control surface an open release does not have.

Models that respect scope. OpenAI's system card reports that, in a test with an out-of-scope honeypot service, GPT-6 Cyber exploited it in 0.07% of graded runs without deployment safety instructions and 0% with them, against 5.51% for GPT-5.6 Cyber. After a summer in which evaluation models at several labs reached real organizations, scope adherence is no longer a footnote. It is still a vendor-run measurement, and it complements environment controls rather than replacing them.

What Gating Does Not Buy

It does not settle who is trusted. A Cloud Security Alliance research note of 3 October 2026 put it precisely: "trusted defender" has become an access-control category that each provider defines. The same note observes that admission makes the provider's guardrails no longer the primary barrier against misuse, which shifts that burden to the admitted organization. An analyst at IDC told CSO Online that a tiered approach "only works if the vetting is real and access keeps being checked after it is granted." Enrolment is a privileged-access problem, with the usual failure modes: a compromised analyst account, a contractor outside the perimeter of the agreement, an acquisition that changes who the enrolled entity is.

It does not stop diffusion. On 17 July 2026 the UK AI Security Institute reported that recent open-weight models lag frontier closed models' cyber capabilities by 4 to 7 months, narrower than the 6 to 10 months it measured through most of 2025. It added that once weights are public, monitoring, classifiers and user bans are unavailable, and described open release of dangerous capabilities as creating "a persistent and irreversible risk of misuse". The Institute's hedges matter: the finding covers cyber only, and it says it is uncertain whether the gap will change. But the planning assumption is plain. What sits behind a gate now is a preview of what is ungated within a few release cycles. Unit 42's NOVA results, which we covered in Zero-day discovery went industrial, made the same point from the other side: nearly every frontier and open-weight model it evaluated could find real vulnerabilities.

It does not make access stable. Our own Velocity Gap timeline is the evidence. Mythos-class capability went from withheld on 7 April 2026 to generally available, as Claude Fable 5 with cyber safeguards, on 9 June 2026: nine weeks. On 12 June the US government applied export controls and Anthropic suspended both Fable 5 and Mythos 5 for all users. Mythos 5 access was approved for a set of US organizations on 26 June, the controls were lifted on 30 June, and Fable 5 returned globally on 1 July, 19 days after it went dark. Eligibility set by a provider, and reviewable by a government, can be narrowed as quickly as it was granted.

It does not patch anything. This is the point the doctrine turns on. Gating changes the order in which parties receive discovery capability. The Velocity Gap is the time between weaponization and containment, and nothing in an access programme shortens containment. A defender admitted to Daybreak Red or Fairwind tomorrow inherits a longer findings list and the same change-approval queue. October showed both halves of that at once: Microsoft's 13 October security update addressed 1,413 vulnerabilities, the figure at the centre of our verified-versus-viral reading of Black October, while the Cairn campaign showed one operator with open-source agents attempting more than 1,200 websites.

Access, Absorption, Exposure: What Changes for the Executive Team

Access. Most organizations will not be direct participants in the highest tiers, and do not need to be. The practical question is whether you are a beneficiary. Which of your security vendors, managed service providers and critical software suppliers are enrolled, in which programme and tier? Is the open-source software you depend on being scanned by someone who is? Where you are eligible yourself, Anthropic's Defense Access and OpenAI's Daybreak Blue are the realistic entry points, and each needs a named internal owner for the commitments that come with enrolment.

Absorption. Before seeking more discovery, measure what happens to the findings you already receive: time from report to triage, triage to fix, fix to deployed. If a supplier in one of these programmes sent you fifty validated findings in a week, which team would take them, and under which change process? Access without absorption capacity widens the backlog.

Exposure. Plan against the capability, not the gate. Assume that what vetted defenders hold now is broadly reachable within months, and prioritize the controls that do not depend on winning the patch race: segmentation, default-deny egress, short-lived workloads, and detection of intrusion behaviour rather than of specific flaws.

The Deal-Side Question

For acquirers and operating partners, gated-model-class tooling changes what a security assurance means. A penetration test or code review completed with conventional tooling describes how the target fared against one level of scrutiny; the level now available to vetted teams is higher. Ask the target, and any security vendor whose report is in the data room, whether the assurance used tooling of this class, under which programme, and what became of the findings: how many were raised, how many are closed, how long closure took. A target that has been scanned at this level and has a long, well-managed remediation list is a better risk than one with a clean report produced by older methods. Where the target is itself enrolled, treat the enrolment as privileged access and diligence the controls around it, including what happens to eligibility on change of control.

Closing

Restricted release to vetted defenders is now how the frontier labs ship cyber capability, and that is better than the alternative. It should not be mistaken for a solution. The gate orders the queue. It does not move the two numbers an executive team controls: how long a reachable flaw stays open, and how far a single compromise can travel.

The Gated-Model Access and Absorption Review establishes where your organization, your vendors and your suppliers sit relative to these programmes, and whether your remediation pipeline can absorb what they produce. It is the conversation to have before the next model in this class is released, gated or not.