Disclosure first: this site is written with Claude, which is made by Anthropic, one of the three companies below. Read the Anthropic section knowing that.

Within days of each other, Google, Anthropic and OpenAI all shipped or announced models explicitly built for cybersecurity work. The announcements are worth reading side by side, because they share a property that none of them mentions.

What each one said

Google released Gemini 3.8 Flash Cyber on 2 September 2026, describing it as its most capable cybersecurity model with "frontier-level performance in autonomous vulnerability discovery". Access runs through the Fairwind Program, restricted to high-priority defenders — governments, healthcare, telecoms — and over 650 partners including CrowdStrike, Palo Alto Networks, Datadog, Menlo Security and Snowflake. Google says it prioritised vulnerability fixing over offensive capabilities like exploitation.

Anthropic released Claude Fable 5.1 and Claude Mythos 5.1. The line that matters is a policy change: "Fable 5.1 can now be used to discover software vulnerabilities—though not to develop exploits for them." Safeguards still redirect penetration testing, exploit generation, and binary-based vulnerability scanning to Opus models. Mythos 5.1 is gated behind a Cyber Verification Program and a Life Sciences Verification Program, currently open only to a set of US organisations.

OpenAI described Astra as meeting the Critical cybersecurity capability threshold under its own Preparedness Framework — a threshold OpenAI defines as independently finding and exploiting zero-days across defended systems, or running a complete attack from high-level instructions without human guidance. Access to the most advanced features runs through a Daybreak Blue programme for a group of testers.

The property none of them mentions

Google says Gemini 3.8 Flash Cyber surpasses Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol.

OpenAI says Astra scores 100% on ExploitBench, declines 91.5% of jailbreaking requests against 59% for GPT-5.6 Sol, discovered and used two zero-days in unnamed software, and chained multiple flaws in hardened operating systems into local privilege escalation.

Anthropic publishes its own benchmark table — Terminal-Bench 4.0 at 55.8% against 42.0% for Fable 5, and so on — and says its cyber safeguards now block 60% fewer false positives.

Every one of those numbers was produced by the company selling the model, measuring the thing it built, on tests it selected. No independent evaluation is cited anywhere in any of the three announcements.

That is normal in AI. It is much less normal in security, where the whole discipline runs on the assumption that a vendor's assessment of its own product is a starting point and not a finding. "100% on ExploitBench" is not a fact about the world; it is a fact about ExploitBench and about who ran it.

OpenAI declared its own threshold crossed

Buried inside a product announcement is a company stating that its model meets the Critical bar of its own safety framework — the one that describes autonomous zero-day discovery and exploitation against defended systems — and shipping it under access controls.

Whatever you think of the claim, that is a significant thing to say out loud, and it will be under-covered because of where it was said.

It also invites the obvious question, which none of these announcements answers: who decides whether the gate holds? Fairwind, Daybreak Blue and the Cyber Verification Program are all vendor-operated allowlists. The safeguard against misuse of a Critical-threshold capability is a company's own customer vetting.

Where Anthropic's line actually falls

"Discover vulnerabilities, but do not develop exploits" is a clean sentence and a genuinely hard line to hold in practice.

Last week Forescout published an experiment in which Claude ported a working pre-auth exploit from one WAGO controller model to another — 8 hours 32 minutes, $535.74, sustained human steering, and a bricked PLC. That is not discovery. It is also not exploit development from scratch: the exploit existed, and the work was adaptation.

Porting is the case the policy sentence does not obviously cover, and it is also the case with the most commercial demand, because the same bug across many device models is exactly where the cost sits.

To Anthropic's credit, the published limitations are specific and unflattering. It says its automated behavioural audit gives less visibility into very long-context work and multi-agent settings, that it has less coverage of impossible tasks than we'd like, and that testing found the model can still sometimes bypass approvals and auto-mode classifiers. Those three sentences are more useful than any benchmark on the page, and they are the ones nobody will quote.

Fewer false positives is a loosening, described as a fix

Anthropic reports Claude Code users can expect around 60% fewer interventions per session from cyber safeguards, and that biology safeguards fire 85% less often on benign elementary questions.

Both are real improvements — a safeguard that blocks legitimate work teaches people to route around it, and that is its own risk. But a control that fires less often is, definitionally, a control that fires less often. Precision and permissiveness are being measured with the same number, and only one of them is in the headline.

The honest version of this metric is a pair: how many benign requests stopped being blocked, and how many harmful ones started getting through. Only the first is published.

What to do

  • Do not treat any of these benchmarks as procurement evidence. Ask for third-party evaluation, or run the model against your own corpus.
  • If you get gated access, you are the control. Fairwind, Daybreak Blue and CVP work only if the organisations inside them behave, and you are inside one.
  • Watch the discovery/exploitation boundary in your own usage. Adapting an existing exploit is the common real-world task and the least clearly covered by any of the three policies.
  • Read the limitations sections. In all three announcements they are the only parts not written by marketing.

What is not established

  • Whether any of the benchmark claims replicate. None has been independently verified.
  • What Astra can actually do. OpenAI describes capability against unnamed software; nothing is demonstrable from outside.
  • How the access programmes vet applicants, or what happens when a vetted organisation is itself compromised.
  • Whether refusal rates hold under sustained adversarial use rather than benchmark conditions.
  • How the discovery-not-exploitation line is enforced in practice, as distinct from stated.