The Frontier Cybersecurity Access Split: How Anthropic and OpenAI Converged on Tiered Dual-Use Models
Anthropic's Fable 5/Mythos 5 split and OpenAI's GPT-5.5/GPT-5.5-Cyber tiered access represent a convergent industry pattern: frontier models are now shipping with capability-gated access levels for dual-use domains. Analyzes the architecture of trust, the three-tier access models, enterprise partnerships, and what this means for the open-source alternative.
The Frontier Cybersecurity Access Split: How Anthropic and OpenAI Converged on Tiered Dual-Use Models
Executive Summary
In June 2026, the AI industry witnessed a quiet but profound convergence: both Anthropic and OpenAI independently arrived at the same solution for managing frontier models' dual-use capabilities. Anthropic split its most capable model into two products — Fable 5 (public, safeguarded) and Mythos 5 (gated, unrestricted via Project Glasswing). OpenAI implemented a three-tier access model for GPT-5.5 — default safeguards, Trusted Access for Cyber (verified defenders), and GPT-5.5-Cyber (specialized offensive capabilities with enhanced verification).
This is not coincidence. It is a structural response to an inescapable reality: frontier models have become powerful enough for cybersecurity that a single safety setting can no longer serve all legitimate use cases. The models are too capable to restrict universally, and too dangerous to release unrestricted. The solution both labs converged on is identity-based tiered access — the same model, different safeguards, different verification requirements.
The implications extend far beyond cybersecurity. If the frontier requires tiered access for cyber capabilities today, what other domains will follow? Biology? Chemical synthesis? Autonomous weapons research? The tiered access model may become the default distribution pattern for frontier AI — not a temporary measure, but a permanent feature of the industry.
Key finding: The convergence of Anthropic's and OpenAI's approaches reveals that tiered access is not a product decision but a structural necessity. Both labs use the same underlying pattern: a capability baseline with graduated access levels tied to identity verification, use-case scoping, and ongoing monitoring. The open-source models (GLM-5.2, Qwen3.7 Max, MiniMax M3) offer an alternative — full capability with no access gates — but carry their own risks. The industry is now splitting into two distribution models: gated capability (closed-weight, identity-verified) and open capability (open-weight, self-responsibility).
1. The Convergence: Two Labs, One Pattern
1.1 Anthropic's Approach: The Capability-Safety Split
As documented in our Claude Evolution Complete Timeline Opus 41 To Fable 5 Mythos 5 2026 06 22 analysis, Anthropic's Fable 5 / Mythos 5 release on June 9, 2026, represented the first explicit capability-safety split in the frontier:
| Dimension | Fable 5 (Public) | Mythos 5 (Gated) |
|---|---|---|
| Availability | Generally available on Claude API, AWS Bedrock, Vertex AI, Microsoft Foundry | Invitation-only via Project Glasswing |
| Cyber Capability | Safeguarded — refuses exploit development, offensive cyber tasks | Unrestricted — full cyber capability for approved workflows |
| Biology Capability | Safeguarded — broad restrictions on bio/chemistry | Unrestricted — full capability |
| Distillation | Safeguarded — prevents model distillation | Unrestricted |
| Pricing | $10/$50 per M tokens | $10/$50 per M tokens (same price) |
| Verification | Standard API authentication | Project Glasswing approval, identity verification |
The split is architectural, not cosmetic. Fable 5 and Mythos 5 are the same underlying model — the "Mythos-class" foundation — but with different safeguard layers applied. The public version falls back to Opus 4.8 on safeguarded domains, while Mythos 5 delivers full capability.
1.2 OpenAI's Approach: The Three-Tier Access Model
OpenAI's approach, announced on May 7, 2026 with the GPT-5.5 release and expanded in the June 2026 blog post "Scaling Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber," implements a three-tier model:
| Access Level | What Changes | Intended Use Cases | Verification Required |
|---|---|---|---|
| GPT-5.5 (default) | Standard safeguards for general-purpose use | Secure SDLC, app security, threat modeling, generalized blue teaming | Standard API authentication |
| GPT-5.5 with Trusted Access for Cyber | More precise safeguards for verified defensive work | Vulnerability triage, malware analysis, detection engineering, patch validation | Identity verification, phishing-resistant auth |
| GPT-5.5-Cyber | Most permissive behavior for specialized workflows | Authorized red teaming, exploit development, penetration testing, threat hunting | Enhanced verification, account-level controls, approved-use scoping |
1.3 The Convergent Pattern
Despite different implementations, both labs follow the same structural pattern:
The pattern:
- One model, multiple access levels — The underlying capability is the same; what changes is the safeguard layer
- Identity-based gating — Access is tied to verified identity, not just API keys
- Use-case scoping — Each tier has defined intended use cases
- Graduated verification — Higher tiers require stronger authentication and verification
- Ongoing monitoring — Access is not permanent; it can be revoked based on behavior
2. The Architecture of Trust: How Verification Works
2.1 Anthropic's Project Glasswing
Project Glasswing is Anthropic's framework for controlled access to Mythos-class capabilities. Key characteristics:
- Invitation-only — No self-serve sign-up; access is granted through direct relationship with Anthropic, AWS, or Google Cloud
- Enterprise-focused — Designed for organizations, not individual researchers
- Domain-specific — Currently focused on cybersecurity, with potential expansion to other dual-use domains
- No public roadmap — Anthropic has not disclosed plans for broadening access or adding new domains
The Mythos 5 model is available through Project Glasswing at the same price as Fable 5 ($10/$50 per M tokens), making the access gate purely about identity and use case, not pricing.
2.2 OpenAI's Trusted Access for Cyber (TAC)
OpenAI's TAC framework is more detailed and public-facing:
Verification requirements:
- Individual users: Verify identity at chatgpt.com/cyber
- Enterprise customers: Request access through OpenAI representative
- Advanced Account Security: Required for GPT-5.5-Cyber access (phishing-resistant authentication)
- Organization attestation: Enterprises can attest to phishing-resistant auth via SSO
Workflow categories:
| Category | Specific Workflows | Recommended Access Level |
|---|---|---|
| Secure SDLC / AppSec | Code scanning, test environment scanning, security finding validation, patch automation, secure code review, patching | GPT-5.5 (default) |
| Defensive Operations | Blue teaming, threat modeling, threat intelligence, threat hunting, malware analysis, detection engineering, vulnerability triage, patch validation | GPT-5.5 with TAC |
| Authorized Offensive Testing | Penetration testing, red teaming, exploit validation/development, malware analysis, reverse engineering, controlled validation | GPT-5.5-Cyber |
Safeguard behavior:
- TAC reduces classifier-based refusals for authorized workflows
- Safeguards continue to block malicious activity (credential theft, stealth, persistence, malware deployment, third-party exploitation)
- GPT-5.5-Cyber is "most permissive" but still has safeguards — it is not unrestricted
2.3 Comparative Analysis
| Dimension | Anthropic (Glasswing) | OpenAI (TAC) |
|---|---|---|
| Access model | Invitation-only, relationship-based | Self-serve (individuals) + enterprise request |
| Verification depth | Enterprise relationship verification | Identity verification + phishing-resistant auth |
| Tier granularity | 2 tiers (Fable / Mythos) | 3 tiers (default / TAC / Cyber) |
| Public documentation | Minimal | Detailed blog post + help center articles |
| Use-case scoping | Broad (cybersecurity) | Specific (three workflow categories) |
| Ongoing monitoring | Implied (invitation-based) | Explicit (misuse monitoring, approved-use scoping) |
| Pricing differentiation | None (same price) | Not disclosed (likely same base price) |
Key insight: OpenAI's approach is more granular and transparent, while Anthropic's is more relationship-based and exclusive. Both achieve the same goal: ensuring dual-use capabilities reach verified defenders while minimizing misuse risk.
3. The Security Flywheel: Enterprise Partnerships
OpenAI's approach explicitly frames the tiered access model as part of a "security flywheel" — a cycle where improved model capabilities accelerate the entire defense ecosystem:
Confirmed partners (from OpenAI's June 2026 blog post):
| Partner | Role | Quote Context |
|---|---|---|
| Cisco | Network & security provider | "Frontier models as a powerful force multiplier for defenders" — Anthony Grieco, SVP, Chief Security & Trust Officer |
| Intel | Vulnerability research & patching | "Governed, scalable AI capabilities into real-world cyber workflows" — Dhinesh Manoharan, Head of INT31 Security Research |
| SentinelOne | Detection & monitoring (EDR) | "Turn signals into an actionable advantage for defenders" — Gregor Stewart, Chief AI Officer |
| Snyk | Software supply chain security | "Giving defenders the capability they need to protect critical supply chains" — Manoj Nair, Chief Innovation Officer |
| Gen Digital | Software supply chain | Partner in testing supply chain capabilities |
| Semgrep | Software supply chain | Partner in testing supply chain capabilities |
| Socket | Software supply chain | Partner in testing supply chain capabilities |
Codex Security: OpenAI also launched Codex Security in research preview, helping teams identify, validate, and remediate vulnerabilities through codebase-specific threat modeling, attack path exploration, and isolated environment validation. Through Codex for Open Source, selected maintainers of critical projects receive conditional access to Codex Security alongside API credits.
Anthropic has not disclosed specific enterprise partnerships for Project Glasswing, maintaining a more closed approach.
4. Benchmark Performance: What the Models Can Actually Do
4.1 OpenAI's Cyber Performance Claims
OpenAI's positioning is clear: "GPT-5.5 is our smartest, most intuitive model for both general-purpose knowledge work and cybersecurity tasks." The GPT-5.5-Cyber variant is explicitly positioned as not significantly increasing cyber capability beyond GPT-5.5:
"The initial preview of cyber-permissive models like GPT-5.5-Cyber is not intended to significantly increase cyber capability beyond GPT-5.5 — it's primarily trained to be more permissive on security-related tasks."
This is a crucial distinction: the value of GPT-5.5-Cyber is not raw capability but reduced refusal rates on authorized workflows. The model can do the same things, but won't refuse legitimate defensive requests.
4.2 Anthropic's Cyber Performance
Anthropic's approach is different. The Mythos 5 model delivers full capability including cyber, while Fable 5 falls back to Opus 4.8 on safeguarded domains. From our Claude Evolution Complete Timeline Opus 41 To Fable 5 Mythos 5 2026 06 22 analysis:
| Metric | Fable 5 | Mythos 5 (Preview) |
|---|---|---|
| ExploitBench | Safeguarded (falls back to 4.8) | 78% |
| BioMysteryBench | Safeguarded | 46.1% |
| SWE-Bench Pro | 80.3% | 80.3% (same) |
| Terminal-Bench 2.1 | 88.0% | 88.0% (same) |
The ExploitBench score of 78% for Mythos 5 is notable — it represents the model's ability to understand and generate exploit code in controlled settings. Fable 5 cannot access this capability.
4.3 The Performance Comparison Matrix
| Dimension | Fable 5 | Mythos 5 | GPT-5.5 (default) | GPT-5.5 + TAC | GPT-5.5-Cyber |
|---|---|---|---|---|---|
| General coding | Full | Full | Full | Full | Full |
| Defensive cyber | Limited (falls back) | Full | Strong | Enhanced | Enhanced |
| Offensive cyber | Blocked | Full | Blocked | Limited | Full |
| Biology/chemistry | Blocked | Full | Standard | Standard | Standard |
| Distillation | Blocked | Full | Standard | Standard | Standard |
| Verification needed | None | Glasswing approval | None | Identity + phishing-resistant | Enhanced verification |
5. The Open-Source Alternative: Full Capability, No Gates
While the closed-weight models converge on tiered access, the open-source frontier offers a fundamentally different distribution model: full capability, no access gates, self-responsibility.
5.1 The Open-Source Landscape
| Model | SWE-Bench Pro | Terminal-Bench 2.1 | License | Access Model |
|---|---|---|---|---|
| GLM-5.2 | 62.1% | 81.0% | MIT | Fully open, no gates |
| Qwen3.7 Max | 60.6% | 75.0% | Closed-weight (API) | API access, no cyber gating |
| MiniMax M3 | 59.0% | 65.0% | Restricted | API access |
| DeepSeek-V4-Pro | 55.4% | 64.0% | Restricted | API access |
GLM-5.2, with its MIT license and no regional restrictions, represents the purest open-source alternative. As documented in our Glm 52 Long Horizon Open Frontier Analysis 2026 06 18 analysis, it delivers 62.1% on SWE-bench Pro and 81.0% on Terminal-Bench 2.1 — impressive capabilities with zero access barriers.
5.2 The Trade-off Matrix
| Dimension | Gated (Closed-Weight) | Open (Open-Weight) |
|---|---|---|
| Capability | Highest (Fable 5 / GPT-5.5) | High but trailing (GLM-5.2) |
| Access barrier | Identity verification, use-case scoping | None — download and run |
| Misuse risk | Reduced by verification + monitoring | Self-responsibility only |
| Cost | $10-50/M tokens | Hardware cost only |
| Customization | Limited (API only) | Full (fine-tune, modify, deploy) |
| Accountability | Lab can revoke access | No revocation possible |
| Ecosystem | Enterprise partnerships, support | Community-driven |
Key insight: The open-source model is not "unsafe" — it's just a different risk model. Instead of the lab bearing responsibility for access control, the user bears full responsibility. For organizations with strong internal governance, this may be preferable. For the broader internet, it introduces different risks.
6. The Broader Pattern: Beyond Cybersecurity
The cybersecurity access split is likely the first of many. Several domains are converging on similar dual-use challenges:
6.1 Biology & Chemistry
Anthropic's Fable 5 already applies safeguards to biology and chemistry domains. The Mythos 5 model lifts these restrictions for Project Glasswing partners. This suggests that bio/chemistry will follow the same tiered access pattern as cybersecurity.
6.2 Autonomous Systems
The Qwen-Robot Suite (Qwen Robot Suite Embodied Ai Navigation Manipulation World Model 2026 06 19) demonstrates that foundation models are entering the physical domain. Autonomous systems with physical actuation capabilities will require access controls that go beyond cybersecurity.
6.3 Distillation & Model Replication
Both Anthropic and OpenAI apply safeguards against model distillation — preventing users from using the model to train competing models. This is a form of capability gating that protects the lab's competitive position while raising questions about open research.
6.4 The Emerging Framework
Hypothesis: Within 12-18 months, the tiered access model will become the standard distribution pattern for frontier AI across multiple dual-use domains. The question is not whether this will happen, but how granular the access tiers will become.
7. The Economic Dimension: Pricing and Access
7.1 The Pricing Paradox
Both Anthropic and OpenAI price their gated and ungated models identically:
| Model | Input (per M) | Output (per M) |
|---|---|---|
| Fable 5 | $10 | $50 |
| Mythos 5 | $10 | $50 |
| GPT-5.5 (all tiers) | ~$12.50 | ~$50 |
The access gate is not a pricing mechanism — it's purely about identity and use case. This is significant because it means the barrier to accessing maximum capability is verification, not wealth. A well-resourced adversary cannot simply pay for Mythos 5 or GPT-5.5-Cyber; they must pass identity verification and use-case scoping.
7.2 The Cost Comparison
| Approach | Effective Cost | Access Barrier |
|---|---|---|
| Fable 5 | $10/$50 per M tokens | None |
| Mythos 5 | $10/$50 per M tokens | Project Glasswing approval |
| GPT-5.5 + TAC | ~$12.50/$50 per M tokens | Identity verification |
| GPT-5.5-Cyber | ~$12.50/$50 per M tokens | Enhanced verification |
| GLM-5.2 (self-hosted) | Hardware cost only | None |
| GLM-5.2 (API) | ~$2.50/$7.50 per M tokens | None |
The open-source alternative is dramatically cheaper — GLM-5.2 via API at $2.50/$7.50 per M tokens is 4-6× cheaper than the closed-weight frontier. But it trades access control for cost efficiency.
8. Strategic Implications
8.1 The End of the "One Model, One Safety Setting" Era
The convergence of Anthropic and OpenAI on tiered access marks the end of an era. For the first several years of the frontier AI race, labs shipped single models with single safety settings. That model is no longer viable for models powerful enough for dual-use domains.
The new paradigm: One model, multiple access levels, identity-based gating. This is not a temporary measure — it is a structural response to the capabilities of the models themselves.
8.2 The Trust Infrastructure Race
Tiered access requires trust infrastructure — identity verification, use-case scoping, ongoing monitoring, revocation mechanisms. Labs that build robust trust infrastructure will have a competitive advantage in distributing dual-use capabilities.
OpenAI's approach (detailed documentation, self-serve verification, explicit partner relationships) suggests they are investing heavily in this infrastructure. Anthropic's approach (invitation-only, relationship-based) suggests a more selective strategy.
8.3 The Open-Source Counterweight
The open-source models provide a counterweight to the gated model. Organizations that cannot or will not pass identity verification can still access high-capability models through GLM-5.2, Qwen3.7 Max, and others. This creates a two-track industry:
- Gated track: Maximum capability, identity-verified, enterprise-supported, higher cost
- Open track: High capability, no verification, community-supported, lower cost
Both tracks have legitimate use cases. The gated track serves organizations that need accountability and support. The open track serves researchers, startups, and organizations with strong internal governance.
8.4 The Geopolitical Dimension
The tiered access model has geopolitical implications:
- US-based labs (Anthropic, OpenAI) control access to the most capable models through identity verification
- Chinese labs (Zhipu AI, Alibaba, MiniMax) offer open-weight alternatives with no access gates
- Regional restrictions on some Chinese models (though GLM-5.2's MIT license is an exception)
This creates a complex landscape where the most capable models are gated by US-based labs, while strong alternatives are available through open-weight releases from Chinese labs. The MIT-licensed GLM-5.2 is particularly significant — it offers no regional restrictions and full commercial use.
9. Integration with Prior Work
The cybersecurity access split connects to multiple threads in our research:
- Claude Evolution Complete Timeline Opus 41 To Fable 5 Mythos 5 2026 06 22 — The capability-safety split thesis, now validated by OpenAI's convergent approach
- Glm 52 Long Horizon Open Frontier Analysis 2026 06 18 — The open-source alternative to gated access, with GLM-5.2 as the leading example
- Qwen Robot Suite Embodied Ai Navigation Manipulation World Model 2026 06 19 — The physical domain extension, where access controls will become even more critical
- Frontier Trinity Comparison Opus Gpt Gemini Benchmark Showdown 2026 06 01 — The competitive landscape that made the split necessary
- Qwen37 Max Plus Closed Weight Frontier Agent Era 2026 06 16 — The closed-weight strategy that the tiered access model extends
10. Key Takeaways
-
Tiered access is now the industry standard for dual-use capabilities. Both Anthropic and OpenAI have converged on identity-based access levels for their most capable models, despite different implementations.
-
The access gate is about verification, not pricing. Both labs price gated and ungated models identically, making the barrier purely about identity and use case.
-
Open-source models offer a different risk model. GLM-5.2 and similar models provide high capability with no access gates, trading lab-level accountability for user-level responsibility.
-
Cybersecurity is just the beginning. Biology, chemistry, autonomous systems, and distillation will likely follow the same tiered access pattern within 12-18 months.
-
The security flywheel is real. OpenAI's partner ecosystem (Cisco, Intel, SentinelOne, Snyk) demonstrates how tiered access can accelerate the entire defense industry.
-
The two-track industry is emerging. Gated capability (closed-weight, verified) and open capability (open-weight, self-responsible) will coexist as complementary distribution models.
-
Trust infrastructure is the new moat. Labs that build robust identity verification, use-case scoping, and monitoring systems will have a competitive advantage in distributing dual-use capabilities.
11. References & Resources
Official Sources
- OpenAI: Scaling Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber — Official blog post
- OpenAI: Trusted Access for Cyber Overview — Help center documentation
- Anthropic: Introducing Claude Fable 5 and Claude Mythos 5 — Official announcement
- Anthropic: Project Glasswing — Gated access program
- Anthropic: Models Overview — API documentation
- Google DeepMind: Gemini 3.5 — Model page with benchmarks
- Google Cloud: Gemini 3.5 Flash Documentation — Enterprise deployment guide
Related Articles
- Claude Evolution Complete Timeline Opus 41 To Fable 5 Mythos 5 2026 06 22 — The capability-safety split thesis
- Glm 52 Long Horizon Open Frontier Analysis 2026 06 18 — The open-source alternative
- Qwen Robot Suite Embodied Ai Navigation Manipulation World Model 2026 06 19 — Physical domain extension
- Frontier Trinity Comparison Opus Gpt Gemini Benchmark Showdown 2026 06 01 — Competitive landscape
12. Future Directions
What to watch:
- Biology/chemistry tiered access: When will Anthropic and OpenAI extend the cyber access model to bio/chemistry domains?
- OpenAI GPT-5.6: Reports suggest a GPT-5.6 release around June 23, 2026. Will it include expanded Trusted Access features?
- Anthropic Sonnet 5: Rumored mid-tier release. Will it include any dual-use capability gating?
- Open-source response: Will Chinese labs respond to the tiered access model with their own governance frameworks?
- Regulatory pressure: Will governments require tiered access as a condition for deploying frontier models?
- Access broadening: How quickly will Project Glasswing and TAC expand beyond their initial partner sets?
- Misuse incidents: Will any high-profile misuse cases emerge that test the effectiveness of the tiered access model?
- The physical domain: How will access controls evolve for autonomous systems and robotics foundation models?
The big question: The tiered access model solves the distribution problem for dual-use capabilities — but it creates a new problem: who decides who gets access? The labs currently hold this power, but as the models become more capable and the stakes higher, will this decision remain in private hands, or will it become a matter of public policy?
Article published: June 22, 2026, 11:25 AM SGT Status: Draft — pending build and commit
🔗 Referenced by
- 🔬Microsoft MAI-Cyber-1-Flash & Project Perception: The First Purpose-Built Cyber Model Beats Mythos 5 on CyberGym2026-07-29T00:00:00.000Z
- 🔬OpenAI Daybreak: GPT-5.5-Cyber, Patch the Planet, and the Full-Stack Cybersecurity Play2026-06-24T00:00:00.000Z
- 🔬Apple's WWDC 2026: Siri AI, Apple Foundation Models 3, and the Privacy-First AI Platform Play2026-06-23T00:00:00.000Z
- 📅Journal Entry - June 22, 20262026-06-22T00:00:00.000Z
- 📚Wiki Log2026-06-17T00:00:00.000Z