- 03
- September
A cyber AI model is a language model whose safeguards and training have been tuned specifically for security work — vulnerability discovery, malware analysis, code review. On 1-2 September 2026, Google, Anthropic and OpenAI all shipped one on the same two days, and every one of them sits behind a vetting programme. This article covers what each lab announced, who is actually eligible, and what organisations outside the first circle should do in the meantime — continuing the trend we tracked in our piece on AI-driven cyber attacks.
In one line: on 1-2 September 2026 Google, Anthropic and OpenAI each shipped a cyber-focused AI model, and all three restricted access to vetted defenders through the Fairwind, Cyber Verification and Daybreak programmes respectively.
What happened in 48 hours
What made this week different from any other model launch was the timing. The three labs did not merely ship close together — they shipped the same kind of thing: models purpose-built for security work, each wrapped in a vetting mechanism that looks suspiciously similar to the other two.
| Date | Lab | Announcement |
|---|---|---|
| 10 August 2026 | OpenAI | Expanded the Daybreak program into two tiers (Blue / Red), launched GPT-5.6-Cyber, and disclosed that it had paused some internal activity involving an upcoming model called Astra while it assessed capabilities and added safeguards |
| 27 August 2026 | 100+ companies | A joint open letter urging both the private and public sectors to act on AI-driven cyber threats — signatories include Anthropic, Google, Microsoft and OpenAI |
| 1 September 2026 | Anthropic | Launched Claude Fable 5.1 (generally available) and Claude Mythos 5.1 (trusted access only), plus Enterprise Frontier Safeguards, which moves monitoring data into the customer’s own cloud |
| 2 September 2026 | Launched Gemini 3.8 Flash Cyber, which it calls its most capable cybersecurity model, available through the new Fairwind Program | |
| 2 September 2026 | OpenAI | Announced that Astra meets the Critical cybersecurity capability threshold under its Preparedness Framework — a first for the company |
Read in sequence, these form a single storyline: the ability of frontier models to find and weaponise vulnerabilities is growing faster than conventional governance can absorb. Every lab reached for the same answer — do not ship this capability to everyone, ship it only to parties whose identity and purpose have been checked.
What each lab shipped, and who can apply
| Lab | Model | Access gate | Who is eligible |
|---|---|---|---|
| Gemini 3.8 Flash Cyber | Fairwind Program | Governments and national cyber authorities, critical infrastructure operators, core technology platforms — all applicants vetted for a proven record of ethical operations | |
| Anthropic | Claude Mythos 5.1 (identical to Fable 5.1, looser safeguards) | Cyber Verification Program / Life Sciences Verification Program | Vetted cybersecurity and life-science professionals; currently limited to select US organisations |
| OpenAI | Astra (upcoming), GPT-5.6-Cyber | Daybreak Blue (frontier general models, relaxed for defensive work) / Daybreak Red (purpose-trained cyber models) | Approved defenders — Astra starts with a small alpha group before reaching Daybreak Blue for defensive work |
Google — Gemini 3.8 Flash Cyber and Fairwind
Google aims this model at two jobs: vulnerability discovery and automated patching. It reports a success rate above 70% on an internal real-world vulnerability benchmark spanning 20 programming languages, and claims that in autonomous vulnerability discovery it outperforms Anthropic’s Mythos 5 and OpenAI’s GPT-5.6 Sol.
That figure comes from Google’s own internal evaluation with no third-party replication yet, so treat it as a direction of travel rather than a score. The more concrete part is the usage condition: Fairwind partners are permitted to perform dual-use tasks only — authorised threat simulation, reverse engineering and malware analysis — and only for defensive or academic research purposes.
Anthropic — Mythos 5.1, where the dividing line is not capability
The common misreading is that Mythos 5.1 is a “stronger” model than Fable 5.1. It is the same model. What differs is the safeguard set — Mythos 5.1 relaxes certain refusals for vetted organisations so that legitimate security and life-science work does not get blocked mid-task. Anthropic says the newest safeguards produce 60% fewer false positives than the previous generation.
We covered the capability and pricing side of this release separately in our deep dive on Claude Fable 5.1. Here the focus is access, which is the part that actually changes what a security team can do this quarter.
Important caveat: as of writing, Mythos 5.1 is available only to vetted professionals at select US organisations. Anthropic says it is coordinating with the US government to widen access to a broader set of domestic and international partners as quickly as possible. In practice, organisations outside that initial circle — including those across Asia-Pacific — are not in scope today.
OpenAI — Astra and the “Critical” line crossed for the first time
OpenAI’s Preparedness Framework grades dangerous capability in tiers, and Critical is the top of the cyber category. The definition is blunt: the model must be able to find and build working exploits against many hardened real-world critical systems without a human guiding each step, or devise and execute end-to-end novel attack strategies given only a high-level goal.
Astra is the first OpenAI model placed in that tier. The published evaluation results:
| Evaluation | Result |
|---|---|
| ExploitBench | A perfect 100% — the benchmark measures turning disclosed vulnerabilities into working exploits |
| 20 high-severity vulnerabilities disclosed mid-2026 | Identified and leveraged two zero-day flaws inside a single exploit chain |
| Browser sandbox | Broke out of the sandbox to run commands on the underlying machine |
| Hardened operating system | Chained several flaws together to reach root-level access |
| Jailbreak resistance | Declined 91.5% of jailbreak attempts, versus 59% for GPT-5.6 Sol |
91.5% sounds like a large improvement, and it is. It also means roughly 9% still get through. When the capability behind the gate is rated Critical, that remainder is not a rounding error — which is exactly why OpenAI is staging Astra through a small alpha group rather than a normal broad launch.
The part that matters more than the models
Read as three separate stories, you get a leaderboard. Read together, you get a structure forming: frontier AI for defensive security is becoming something someone has to unlock for you. Fairwind requires vetting. Cyber Verification requires vetting. Daybreak requires approval. Three names, one mechanism.
The asymmetry to accept: defenders file paperwork, wait for review and accept usage terms. Attackers use the generally available models today, with no application form. That timing gap is what the 27 August open letter from 100+ companies was warning about, and it is why security planning should assume you will not be granted access in this round.
The pattern itself is not new. We saw the outline when OpenAI shipped GPT-5.4-Cyber behind Trusted Access, and again when Anthropic launched Project Glasswing and Claude Mythos went hunting for old CVEs. What changed this week is that it stopped being one lab’s experiment and became an industry norm in a matter of months.
Where organisations outside the first circle stand
There are three doors, and only one of them can be opened without an invitation.
| Door | Who can walk through | What it takes |
|---|---|---|
| Google Fairwind | National cyber authorities, critical infrastructure operators | Applications are institutional, backed by a verifiable security track record — not a channel for a corporate IT department |
| Anthropic Cyber Verification | Vetted cyber teams, currently limited to US organisations | Wait for the programme to widen internationally; no public timeline has been announced |
| Generally available models + operational discipline | Every organisation | Use the public models (Fable 5.1, for example) for work that needs no relaxed safeguards: code review, log triage, patch prioritisation, incident documentation |
The share of security work that genuinely requires relaxed safeguards is smaller than most people assume. Live malware analysis and writing proof-of-concept exploits belong to specialist teams. The work that consumes most of a corporate IT team’s week — reading thousands of log lines, tracking which servers are still unpatched, reviewing a change, writing up an incident — is already well within reach of the generally available models.
What you can do today without waiting for access
In Thailand this intersects with obligations that are already in force, such as the NCSA cloud and website security standards that took effect this month, and with the attack-rate data we summarised in our analysis of cyber attacks against Thai organisations. The five items below give the highest return per unit of effort, and none of them require anyone’s permission.
- Shorten the patch cycle. When the other side’s tooling finds exploits faster, a quarterly patch rhythm becomes a standing risk. The lesson from the CVSS 9.8 flaw in SAP NetWeaver is that the gap between patch release and patch deployment is a window you left open yourself.
- Close management surfaces that face the internet. Database admin consoles, management ports and back-office login pages should not be reachable from outside without a VPN.
- Enforce two-factor authentication on privileged accounts. The most effective attacks still run through real stolen credentials, not novel exploits.
- Collect logs properly, and actually read them. AI is very good at reading logs. It cannot help if there are no logs to read.
- Watch what you feed into AI tools. Prompt injection and context leakage are risks you create on your own side — see our article on prompt injection and business systems.
Why this reaches your ERP
An ERP system is a higher-value target than almost anything else on the network, because it concentrates financial records, supplier data, personnel data and approval authority in one place. As vulnerability-discovery tooling gets dramatically faster, an internet-facing system with default hardening simply gets found sooner.
On the Saeree ERP side we anchor on three things we can actually control: on-premise deployment or a cloud the organisation chooses, so data stays in a jurisdiction the organisation can defend to an auditor; two-factor authentication on accounts that carry approval authority; and role-based permissions that reach down to which records each user can see.
For connecting AI to business data we use MCP, on the principle that the ERP is the source of truth and the AI is an assistant that reads and proposes — never the decision-maker. Every call runs under that user’s own permissions and lands in the audit trail. That position matches what this week’s news is really saying: when model capability outruns the control mechanisms around it, the thing left under your control is the boundary of what you let it touch.
Good news if you are not on the list: the Critical-tier capability making headlines is the ability to discover previously unknown flaws — which is not how most organisations actually get breached. The historical pattern is dominated by vulnerabilities that already had a patch nobody applied, and by stolen user accounts. Both are fixed with discipline, not with frontier models.
The best tools for defenders are becoming something you have to be granted. Attackers were never asked to apply. An organisation that spends this quarter waiting for access is spending it on the one variable it does not control, instead of closing the doors it left open itself.
- Paitoon Butri, Grand Linux Solution Co., Ltd.
References
Information verified as of 3 September 2026.
- The Hacker News — Google, Anthropic, and OpenAI Unveil Cyber AI Models, Safeguards, and Access Programs (2 September 2026)
- SecurityWeek — OpenAI’s Astra Becomes First Model to Cross ‘Critical’ Cybersecurity Threshold
- Google DeepMind — Fairwind Program
- Google DeepMind — Gemini 3.8 Flash Cyber
- Anthropic — Introducing Claude Fable 5.1 and Claude Mythos 5.1
- OpenAI — Expanding Daybreak as the Cyber Defense Window Narrows
- OpenAI Help Center — Daybreak: Trusted Access for Cyber
- TechCrunch — Open letter signed by 100+ companies (27 August 2026)
Interested in an ERP for your organisation?
Talk to the Grand Linux Solution team about on-premise deployment, two-factor authentication and role-based permissions in Saeree ERP.
Request a Free DemoTel 02-347-7730 | sale@grandlinux.com
