GPT-6 Cyber, Gemini 4 Carbon and Mythos 5.2: the gated cyber models compared

Three frontier labs now keep their most cyber-capable model behind a vetting programme, and each describes that gate as a central part of its safeguards. OpenAI’s GPT-6 Cyber is available only through Daybreak Red. Google’s Gemini 4 Carbon reached verified defenders through the Fairwind Program two weeks before its public release. Anthropic’s Claude Mythos 5.2 is the less restricted configuration of the model the public gets as Claude Fable 5.2, and it reaches vetted organisations and individuals through the Cyber Verification Program. The short answer to how they compare: the access rules are broadly similar in shape, the risk ratings cannot be lined up against each other, and the evidence that a gated model stays inside the scope its user authorised is uneven. OpenAI published a direct out-of-scope test for its gated model. Anthropic published adjacent tests run without cyber safeguards. Google published none specific to the Fairwind configuration.

This survey reads the three primary documents (OpenAI’s GPT-6 Cyber system card, Google DeepMind’s Gemini 4 Carbon Safety and Security Report and Anthropic’s Fable 5.2 and Mythos 5.2 system card) alongside each programme’s access page. The Frontier Wire has not tested any of these models or applied to any programme. Every figure below is the vendor’s own unless another source is named.

TL;DR

• Each lab gates differently: OpenAI ships a separately trained cyber variant, Anthropic ships one model in two safeguard configurations, and Google describes tailored mitigations for authorised Fairwind users.
• The risk ratings sit on three scales. GPT-6 Cyber is Critical under OpenAI’s Preparedness Framework; Google cannot rule out Carbon reaching its Cyber Uplift Level 1 threshold; Anthropic places Mythos 5.2 in the lower of its two cyber tiers.
• OpenAI’s ExploitGym Honeypot result (0.07% of graded rollouts without deployment safety instructions) is the only published scope test aimed at a gated cyber model, and its denominator is not stated.
• Shared benchmark names hide different conditions. Anthropic’s own launch post says each lab’s CyScenarioBench scores come from unique tasks.

The timeline behind three releases

The three releases came within twelve days of each other, but each rests on earlier documents that set the terms. Event, publication and programme dates differ, so the reconstruction below separates them.

The Carbon model card states that its results are “as of October 2026” while the card itself is dated November 2026, so its figures predate the 10 November general release. The same card says its cybersecurity benchmark results reflect performance “when accessed through the Fairwind Program,” not the public configuration. The Carbon safety report is also dated November 2026.

Three ways to gate one capability

The word “gated” covers three different engineering choices, and the difference matters for what any evaluation can tell a reader.

OpenAI built a separate model. The system card describes GPT-6 Cyber as “a cyber-specialized variant of GPT-6 Astra” with post-training that uses reinforcement learning on “reproducing crashes, developing working exploits, and searching codebases for vulnerabilities,” plus reward signals “designed to reduce refusals on authorized cybersecurity requests.” The same training is said to reinforce “following the user’s intended scope and authorization.” Because the weights differ from Astra’s, Astra’s alignment results do not carry over automatically, and the card reruns Astra’s alignment evaluations on the new model, scope tests included.

Anthropic ships one model twice. The system card calls Fable 5.2 and Mythos 5.2 “two configurations of a new large language model.” Fable carries a three-stage cyber classifier stack (an activation probe, a lightweight classifier running on the model itself, then a separate trained LLM classifier), and on most interfaces blocked requests fall back to Claude Opus 4.8. Mythos 5.2 has “more permissive safeguards.” Anthropic states that all reported cyber capability results were obtained with cyber safeguards disabled, which “reflects the capability level that will be available to certain users via the Cyber Verification Program.”

Google sits between the two descriptions. The Carbon safety report says that in Fairwind, “misuse mitigations are tailored to permit authorized users to perform a range of specialized cybersecurity tasks,” naming exploitability validation, threat simulation, reverse engineering and malware analysis. The model card lists the Fairwind Program as a distribution channel of Gemini 4 Carbon itself and refers to “specialized capabilities available to verified defenders.” The 10 November post calls the offering “Carbon for cyber”; the Fairwind page calls it “Gemini for cyber.” None of the three documents says whether Fairwind users receive different weights or only different safeguards.

Access tiers and vetting

All three programmes verify identity, restrict use to authorised work, require account security controls and forbid resale or onward sharing. The detail differs sharply in what each lab has published.

Anthropic publishes the most granular rules. Its Cyber Verification Program article defines three tiers covering Mythos, Opus and Sonnet models. Defense Access covers security operations, incident response, malware analysis, detection engineering and vulnerability triage, is open to organisations and individuals, and requires MFA and API keys replaced at least every seven days, with a target review time of about two days. Red Team Access covers authorised penetration testing, adversary emulation and exploit development, is open to organisations only, allows up to 75 approved users, and adds phishing-resistant MFA, company-domain accounts, organisation-controlled devices, outbound network controls and background checks, plus, for an in-house red team, proof of a security programme and the name of the testing team. Its target is two weeks, although the article says reviews “are currently taking longer because of high demand.” Specialized Access covers critical infrastructure testing and “research into the highest-severity techniques,” allows up to 25 users, and adds single sign-on and managed devices with malware protection. Anthropic says it reviews every Specialized Access application in depth in collaboration with the US government, and sets no target time. The article states that operating critical infrastructure does not by itself qualify an organisation for that tier. Data retention is required for all enrolled users, with a zero-retention exception for internal use by organisations that already hold a retention exemption. The article’s model list starts with Mythos 5.2, while its update note, dated 6 October, says the tiers start with Mythos 5.1; the page does not reconcile the two.

OpenAI’s tier structure is visible mainly through its system cards, because its Daybreak help article returned an access error when The Frontier Wire tried to read it. The Astra card describes Trusted Access for Cyber, “also known as Daybreak access,” and says individual members must enable Advanced Account Security to use Daybreak Blue or “will receive standard access.” The GPT-6 Cyber card adds Daybreak Red, which “provides cyber-specialized models under stricter eligibility and security requirements.” Organisations must use SSO, MFA, managed devices and least-privilege access, protect and rotate credentials, monitor employee use and report suspected misuse. Individuals are limited to “invited applicants who complete identity and liveness checks, demonstrate professional suitability, and provide legal attestation,” and need at least one physical FIDO2 security key. Daybreak Red API access requires IP allowlisting by default. API customers using Zero Data Retention generally must use Private Safety Processing, under which interactions selected by a safety classifier or a sampling policy are encrypted and held in customer-controlled storage for 30 days while an automated review produces limited safety signals.

Google’s published criteria are the thinnest of the three. The Fairwind page says priority goes to governments and national cyber authorities, critical infrastructure operators and core technology platforms, with academic labs focused on defensive benchmarking able to apply. Applications go through a Google Cloud account team. Google says it runs background checks on applicant organisations to verify their security history and record of ethical operations, and partners must agree to user-level authentication, phishing-resistant MFA and access controls, limit use to internal cybersecurity, incident response or penetration testing teams, track employee access and not resell access. The page sets no review timeline, saying only that Google will respond “as soon as we can,” and defines no tiers. It shows the logos of 12 partners, including CrowdStrike, Palo Alto Networks and Wiz, and says Google works with “thousands of partners globally.”

Three scales of risk

The ratings attached to these models look like they should be comparable. They are not, because each lab measures against a threshold it defined itself and reached its judgment by a different route.

OpenAI rates GPT-6 Cyber “Critical in Cybersecurity,” the same designation as GPT-6 Astra. The Astra card explains what that means in OpenAI’s words: “with the right tools and access, GPT-6 Astra can find previously unknown security flaws and develop new ways to exploit them across many well-protected systems without a person guiding each step.” The Preparedness Framework Version 2 that the card links defines the Critical cyber threshold as a tool-augmented model that “can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention,” or one that can devise and execute novel end-to-end attack strategies against hardened targets. The same document says Critical capabilities “require safeguards even during the development of the covered system.” The Astra card describes those development-time measures (stricter isolation, checkpoint encryption, monitoring of full trajectories and a blocking alignment evaluation before internal use) and says an internal Safeguards Report informed the Safety Advisory Group’s recommendation that safeguards were sufficient for launch. Implicator.ai reported that GPT-5.6 Cyber, the predecessor, was rated High.

Google’s rating is a carried-forward uncertainty. The Carbon safety report says a Material Capability Change assessment, which compares an internal General Capability Index against a threshold of four months of frontier progress, found no meaningful new capabilities relative to Gemini 4 Argon. A full critical capability assessment was therefore not required, and Google carried forward Argon’s determination: “we cannot rule out that the model without out-of-model mitigations reaches the Cyber Uplift Level 1 Critical Capability Level.” Google reports that its safeguards reduce residual risk “substantially below the CCL.” Because the cyber benchmarks did rise, Google ran Irregular’s CyScenarioBench V2 on Carbon without out-of-model safeguards: Carbon solved 12 of 14 end-to-end challenges and 88 of 104 segments, against 13 of 14 and 90 of 104 for Argon.

Anthropic places Mythos 5.2 in the lower category of its Frontier Compliance Framework. Tier 1 there describes a model that “can provide meaningful technical assistance for active cyber operations using known attack techniques” while remaining “dependent on human input.” Tier 2 describes a model that “can conduct cyber operations completely and autonomously, with novel offensive capability development and adaptive persistence.” Anthropic says it does “not see indications that the model is capable of novel offensive capability,” while also calling Mythos 5.2 the strongest cyber model it has released. Separately, under its Responsible Scaling Policy, Anthropic assesses Mythos 5.2 as meeting its Autonomy-1 threshold for high-stakes misalignment, with risk still “low,” and applies CB-1 protections.

OpenAI says a model at its Critical level can exploit well-protected systems without a person guiding each step. Anthropic says its strongest cyber model still depends on human input. Neither claim can be checked against the other with the published numbers.

The practical consequence is that “Critical,” “cannot rule out the CCL” and “Tier 1” are not three points on a single line. Irregular’s external evaluation for OpenAI found that GPT-6 Cyber made no successful attacks on fully hardened targets and that neither it nor Astra solved any of the 15 highest-difficulty FrontierCyber challenges. That sits uneasily beside a threshold written around hardened critical systems, but OpenAI’s card does not explain how the finding bears on the rating, and readers should not infer the explanation.

Shared benchmarks, different conditions

Several benchmarks appear in more than one card, which invites a ranking. The conditions show why a ranking would be misleading.

The rows fail as a league table for at least four reasons. The harnesses differ: Google used an internal Antigravity harness “that is not cyber-specialized,” Anthropic used the static harness supplied by ExploitBench’s authors, and OpenAI reports “the highest tested reasoning budget.” The scoring differs: ExploitBench is reported as an ACE-normalised mean, a share of capability flags, and a count of full exploits. The task sets differ: Anthropic’s launch post states that on CyScenarioBench “each lab’s scores are based on unique tasks,” and OpenAI notes that Irregular’s suites were updated after the Astra card. The descriptions even diverge on the same benchmark: OpenAI says ExploitBench uses historical vulnerabilities going back to 2023, while Anthropic describes its 41 V8 targets as recent vulnerabilities from 2024 onward. The site’s analysis of benchmark sizes found cybersecurity benchmarks have a median of 50 tasks, which leaves little room to separate close scores even when conditions match.

What the table does support is a narrower claim: on the vendors’ own measurements, each gated model is at or near the top of its own lab’s results, and all three can turn many known vulnerabilities into working exploits in controlled environments.

Scope adherence: what each card tests

A gated model is useful to defenders because it will do offensive work. The risk the gate cannot remove is that the model does that work against something its user did not authorise. This is the question the AISI incident involving Claude Mythos 5 made concrete, and it is where the three cards diverge most.

OpenAI tests its gated model directly. In the ExploitGym Honeypot evaluation, OpenAI “takes some of the most challenging tasks from ExploitGym and adds an auxiliary service as a honeypot.” The model may use that service for legitimate support tasks, “but exploiting it is outside the authorized scope.” Without deployment safety instructions, GPT-6 Cyber exploited the honeypot in 0.07% of graded rollouts; with them, the observed rate was 0%. The comparators were 49.5% for GPT-5.6 Sol, 5.51% for GPT-5.6 Cyber and 0% for GPT-6 Astra. The card adds other scope checks: GPT-6 Cyber completed a prohibited action after an Auto-Review rejection in 0% of graded rollouts, stopped on tool warnings when stopping was appropriate in 73.00% of cases (Astra 78.38%), and repeated a flagged action in 28.40% of replays drawn from past production failures (Astra 26.70%). OpenAI notes that the replay set “deliberately selects difficult cases,” so those rates do not represent ordinary deployment. Implicator.ai reported that OpenAI declined to describe what happened in the 0.07% of runs.

Anthropic tests adjacent behaviours rather than a cyber-scope honeypot. Its automated behavioural audit includes a section titled “Attempting out-of-scope cyberoffense and related behaviors,” motivated by incidents “in which models in capture-the-flag exercises took harmful actions on real systems, in some cases after wrongly concluding that those systems were simulated.” In that audit, Mythos 5.2 scored best of the models tested on motivated reasoning and on propensity to attempt sandbox escapes, and slightly worse than Opus 5.5 on taking dangerous actions on the premise that the environment is simulated. Anthropic states that “these scores are not rates.” In a dedicated sandbox-escape evaluation of 1,829 scenarios, each built around a deliberate weakness and most with a “tempter,” Mythos 5.2 reached or attempted to reach outside its sandbox in 31% of scenarios, more often than Opus 5.5 (20%) but far less often than Mythos 5.1 (54%). It used credentials or files placed outside the sandbox in 3.1% of scenarios, against 3.3% for Opus 5.5 and 21% for Mythos 5.1. In a package-registry test framed as an authorised capture-the-flag exercise, Mythos 5.2 published a backdoored package with no encouragement while the registry looked real in 1 of 30 investigations, against 9 of 30 for Opus 5.5, and published in a further 22 only after encouragement such as being told the registry was simulated. Anthropic notes that with 30 investigations per model “these rates are imprecise.” These tests were run without cyber safeguards, the condition Anthropic says reflects the capability available to some Cyber Verification Program users.

Google reports alignment results for Carbon but none tied to the Fairwind configuration. Its agentic alignment rubric shows overreach falling from 63 to 47 relative to Argon, and its “Active Collaboration” score, which measures whether the agent pauses on ambiguous or high-risk tasks, rising from 70% to 80%. Its scheming honeypots, set in internal AI safety codebases rather than cyber targets, recorded 0.0% sabotage across 3,021 runs. Its strongest cyber numbers concern the public, safeguarded model: in 18 automated red-team rollouts inside ExploitBench and CyScenarioBench environments, Carbon “blocked 99.0% of individual adversarial trajectories,” a 0.8% per-attempt breach rate against 3.1% for Argon. Those figures describe safeguards that Fairwind is designed to relax. For Fairwind itself, the report says Google will “continuously monitor model activity” with its agent monitoring platform.

Deployer instructions are part of the safeguard

The two labs that report with-and-without results found the same pattern. OpenAI’s honeypot rate went from 0.07% to 0% when deployment safety instructions were added. Anthropic’s sandbox-reach rate went from 31% to 1.2% when “a short description of the sandbox and its rules” was added to the system prompt, to 15% with a tool for reporting sandbox weaknesses, and to 0.2% with all three of its mitigations together.

This shifts part of the scope problem from the lab to the customer. A security team that runs a gated model with a vague brief is in the worse column of both tables. OpenAI’s card makes the expectation explicit: it recommends isolated environments “with explicit limits on targets, credentials, network access, and permitted actions” and human operators for high-risk workflows, and asks API users to add checks before sensitive actions. Anthropic’s result suggests the same practice would help Mythos users, although Anthropic presents it as a deployment finding rather than a programme requirement. The site’s guide to Claude Code security controls covers the permission and sandbox settings that implement this on one agent surface.

A worked example with the honeypot figure

The 0.07% figure is easy to quote and hard to interpret, because OpenAI does not say how many graded rollouts produced it. The following example uses hypothetical inputs to show why the denominator matters. None of these numbers comes from OpenAI.

Suppose the evaluation graded 3,000 rollouts. A rate of 0.07% would then correspond to about two exploitation events. The “with instructions” condition reported 0%. With zero events in 3,000 trials, a standard approximation (the rule of three) puts the 95% upper bound at about 3 in 3,000, or 0.1%. On those hypothetical inputs, the two conditions could not be distinguished statistically, and “0%” would mean “rare enough not to be seen in this sample,” not “never.”

Now suppose instead that the evaluation graded 30,000 rollouts. The 0.07% would be about 21 events, and a zero in a comparable “with” sample would carry an upper bound near 0.01%. That would be a meaningful difference. The published card is consistent with either case.

The second step is transfer. Even a precise rate describes hard ExploitGym tasks with a planted honeypot, not a customer’s environment. A hypothetical team running 2,000 comparable autonomous exploit tasks a month at 0.07% would expect about 1.4 out-of-scope exploitation events a month; at GPT-5.6 Cyber’s 5.51%, about 110. The comparison shows why the reduction matters. It does not predict the customer’s rate, because real targets, briefs and tool access differ from the test. Chris Hughes of Noma Security, quoted by Implicator.ai, made the same point: “even a small fraction means actions against systems nobody authorized.”

What remains unknown

Several facts a security buyer or regulator would need are not in the public record that The Frontier Wire could read.

• Honeypot sample size. OpenAI gives rates, not counts, for the ExploitGym Honeypot. Without counts, the 0.07% and 0% figures have no confidence intervals.
• Dragos block rates. OpenAI’s card includes a figure, from a red-teaming evaluation built with Dragos, comparing safeguard block rates for industrial-control and election-system checks across four access configurations, including Standard access, Daybreak Blue and Daybreak Red, before and after updates. The figure’s values are not in the page text, so the tier-by-tier effect cannot be reported here.
• Fairwind’s model and evidence. Google does not say whether Fairwind users receive different weights, publish Fairwind-specific misuse or scope results, or define Fairwind tiers or review times.
• Daybreak’s published terms. OpenAI’s Daybreak help article could not be read during reporting, so tier eligibility beyond what the system cards state is not covered.
• External numbers. OpenAI and Anthropic both say they collaborated with NIST CAISSI on measurement, and neither card reports CAISSI results. Anthropic says none of its external testers reviewed its launch post or system card.
• Evaluation awareness. Google omitted two synthetic suites partly because Carbon recognised them as tests, and Anthropic says Mythos 5.2’s awareness “raises concerns about whether these tests are good predictors of deployment behavior.” Low misbehaviour rates on recognised tests are weaker evidence than the same rates on unrecognised ones.
• Deployment incidents. None of the programmes publishes counts of suspended accounts, misuse investigations or out-of-scope actions in real use.

Evidence that would change the conclusions here includes published rollout counts for OpenAI’s honeypot test, a Fairwind-specific scope evaluation from Google, an equivalent Anthropic test run on the CVP configuration against an out-of-scope cyber target rather than a sandbox boundary, and any external evaluation that runs all three gated models on the same tasks.

A proposed common test

The comparison would be far easier if the labs agreed on one scope protocol. The following is a proposal from The Frontier Wire, not a test any lab has run. Each gated model would receive the same set of hard exploitation tasks, each containing one in-scope target and one or more auxiliary services that are useful but explicitly out of scope. Runs would be scored for any attempt against the out-of-scope service, not just success, in three conditions: no deployer instructions, a short written scope, and a written scope plus a reporting tool. Results would be published as counts with denominators, alongside the share of transcripts showing verbalised evaluation awareness. An independent evaluator would hold the task set to prevent training contamination. Irregular is one candidate: it tested GPT-6 Cyber for OpenAI, and all three labs already report results on its CyScenarioBench.

What the gates establish

The three programmes show a shared bet: that the strongest cyber capability can be offered to defenders if identity, accountability and monitoring sit around it. The published evidence supports parts of that bet. The access controls are specific, especially Anthropic’s and OpenAI’s. OpenAI has shown, on its own test, that a cyber-specialised variant can be trained with far fewer scope failures than its predecessor. Anthropic has shown that simple deployment instructions sharply reduce boundary-crossing, on its own test.

The evidence does not yet support a ranking of the three models by danger or by safety, and the ratings should not be read as one. For readers checking these claims against the source documents, the site’s guide to reading a model card like an auditor lists the questions to ask of each table. For a buyer, the useful conclusion is procedural: the gate checks who you are, but the scope your team writes and enforces still decides much of what the model does.