Every frontier lab now has a gated cyber model: Glasswing, Daybreak, Fairwind, MDASH

On September 2 Google DeepMind released Gemini 3.8 Flash and, next to it, Gemini 3.8 Flash Cyber. The standard model is on every price list. The Cyber variant, which does advanced vulnerability detection and auto-patching, is only reachable through a new Fairwind Program for vetted governments, critical infrastructure operators and open-source maintainers. That was the last piece. As of this week every major lab runs the same two-tier structure: a public model with deliberately damped offensive cyber capability, and a restricted sibling you apply for.

How the pattern formed

The first move was Google's Gemini 3.5 Flash Cyber on July 21, available to governments and trusted partners only. At the time it sat alongside Anthropic's Mythos, already approval-gated through Project Glasswing, a program covering more than 150 organisations in 15 countries, and Microsoft's Project Perception. It looked like an exception category: security-tuned models that vendors chose not to release broadly.

Then September happened. On September 1 OpenAI announced that Astra was its first model to cross the "Critical" threshold for cyber capability in its Preparedness Framework. The evidence is specific: Astra scored 100% on ExploitBench, found two previously unknown vulnerabilities in V8, the JavaScript engine in Chrome, and built an exploit chain that escaped the browser sandbox and ran commands on the host after the browser opened an HTML file. OpenAI said access to its strongest cyber capabilities would be restricted at release; the GA rollout of GPT-6 Astra a few days later went through a phased cyber program called Daybreak, with stricter isolation, encrypted checkpoints and trajectory monitoring.

Anthropic's current version of the same split is Claude Fable 5.1 and Mythos 5.1: the same model at two safeguard levels, with Mythos reserved for vetted organisations in cybersecurity and life sciences. Microsoft's program is now referred to as MDASH. So the map on September 8 reads: Anthropic Glasswing, OpenAI Daybreak, Google Fairwind, Microsoft MDASH.

What an enterprise security team can actually get

If you run security for a company that is not a government or a critical-infrastructure operator, the honest answer is: the public tier, plus whatever your vendor's vetting program admits you into. The programs differ in who they target.

• Google Fairwind: vetted governments, critical infrastructure and maintainers. Vulnerability detection and auto-patching on the Cyber variant.
• Anthropic Glasswing / Mythos: approval-gated, cybersecurity and life-sciences organisations, more than 150 orgs in 15 countries at last count.
• OpenAI Daybreak: phased access to Astra's Critical-tier capabilities, with monitoring conditions attached.
• Microsoft MDASH: the least publicly documented of the four; treat details as unverified until Microsoft publishes them.

The practical consequence is that "which model do we use for security work" is now a procurement and legal question before it is a technical one. The public models still write detection rules, triage CVEs and explain exploits. What they refuse or degrade is autonomous discovery and chaining against hardened targets, which is precisely what Astra demonstrated on V8.

Gating does not make a capability safe. It decides who gets it first, and buys the rest of us time to patch.

What to do with the time

• Assume the capability exists at your adversary's level within months, whether or not you can get it. Astra's V8 chain is the reference case for what a Critical-tier model does unattended.
• Apply to the program that matches your sector now, not when a breach forces the question. Vetting takes time.
• Compress your patch window. AI-driven discovery shrinks the gap between disclosure and weaponisation; a quarterly patch cadence is no longer a defensible policy.
• Red-team your own agents with the public tier. What a damped model still finds in your stack is a floor, not a ceiling; I wrote up a process in LLM security red teaming.
• Budget for the price cliff. Gemini 3.8 Flash holds $0.75 per million input and $3.75 output only until December 31, then doubles to $1.50 / $7.50 on January 1, 2027.

The honest gap

Every capability number above is vendor-reported: Astra's 100% on ExploitBench and the V8 chain come from OpenAI's own announcement, Fairwind's feature list from Google. No independent lab has been allowed to benchmark the gated tiers, which is the point of gating and also its weakness. We are taking the vendors' word for both what the restricted models can do and how much the public ones have been damped.