Brief · Both

The Labs Locked Out the Wrong People

By alkizz · Oct 16, 2026

The labs say the gates are for safety. Anthropic's version: "Cybersecurity is inherently dual use," so its generally available models "have conservative cyber safeguards that block most cyber work." OpenAI says that because intent is ambiguous, "restrictions intended to prevent harm have historically created friction for good-faith work."

What exists

OpenAI: Trusted Access for Cyber, now Daybreak. Blue means reduced refusals on mainline models. Red means cyber models like GPT-5.5-Cyber, for "approved business and enterprise organizations" only.
Anthropic: the Cyber Verification Program, with Defense, Red Team, and Specialized tiers. Individuals can get Defense only. Claude Mythos is the gated cyber line.
Google: the Fairwind Program, for governments and trusted partners, with Gemini 3.8 Flash Cyber and Gemini 4 Argon.
Meta: open weights, plus a Llama Defenders Program for select partners. No public cyber-model enrollment.
xAI/SpaceXSI: no public cyber access program. Its framework says it "may selectively allow" vetted users.

Where it breaks for researchers

Silent downgrades. OpenAI's own system card says it routes "some high-risk traffic to less capable models." In GitHub issue #11842, users who asked for gpt-5.3-codex saw gpt-5.2 instead, including some who had completed cyber verification. OpenAI added a CLI notice later.
False positives, even after approval. Two Claude Code issues (#67966, #93374) report program-approved researchers getting blocked on authorized work.
Evaluators fall back. The Batch reports that Claude Fable 5 routed flagged prompts to Opus 4.8 on about 8% of Artificial Analysis Intelligence Index tasks.
Academics shut out. Glasswing's partner list has no universities. Bruce Schneier: "Fifty companies… cannot substitute for the distributed expertise of the entire research community."
Safe harbor stops at the lab's own systems. Anthropic's disclosure policy excludes "red-teaming, adversarial testing of our models." Google's AI bug bounty rules out jailbreaks. The 2024 safe-harbor letter got piecemeal movement: OpenAI widened its terms, and Anthropic launched a model safety bounty. No lab adopted the letter in full.

The labs' side, fairly

The misuse is real. Anthropic reports a Chinese state-sponsored group (high confidence) used Claude Code against about 30 targets, and it reports "vibe hacking" extortion. Google's threat intel team documents malware that calls AI mid-execution. The labs argue that identity-gated tiers plus monitoring are the compromise.

My take

Locking out legitimate researchers makes models less secure. Attackers move to open weights or another provider. Defenders take the friction: blocked tasks, silent model swaps, and nobody outside the partner club can check the claims. To be honest, nobody has public data on whether these gates reduce attacker success. Not the labs, and not me.

What to do: - Security teams: apply to the program for your work (Daybreak, CVP, Fairwind) early. Daybreak needs a FIDO2 hardware key. Keep written authorization and scope on file. - Log which model actually answered. If the response doesn't name the model you asked for, treat the results as suspect. - Keep an open-weight fallback for defensive work you can't afford to have blocked. - Labs: offer safe harbor for testing the models, not just the infrastructure. Tell users when they've been downgraded. Give people a real appeals path.

Sources

← All briefs

The Labs Locked Out the Wrong People

What exists

Where it breaks for researchers

The labs' side, fairly

My take

Sources

Related

On the checklist

More briefs