Why Every Lab Suddenly Has a 'Cyber' Model

Google just shipped Gemini 3.5 Flash Cyber, a fine-tune of Gemini 3.5 Flash built specifically to find and fix software vulnerabilities. It landed on July 21, 2026 — the exact same day as Sakana AI's Fugu-Cyber, a cybersecurity-specialized variant of its Fugu orchestrator. Two and a half months earlier, on May 7, OpenAI had already shipped GPT-5.5-Cyber. Three frontier labs, three "Cyber" models, all within one summer. That's worth pausing on.

The same shape, three times

Line all three up and the pattern is obvious:

• GPT-5.5-Cyber (OpenAI, May 7): 85.6% on CyberGym, part of OpenAI's "Trusted Access for Cyber" / Daybreak initiative, restricted to vetted cybersecurity teams.
• Fugu-Cyber (Sakana AI, July 21): 86.9% on CyberGym, a specialized version of its multi-model orchestrator, gated behind a manually-reviewed access request.
• Gemini 3.5 Flash Cyber (Google, July 21): 83.2% on CyberGym — close behind GPT-5.5-Cyber despite being built on a much smaller, cheaper base model — restricted to governments and trusted partners through Google's CodeMender agent.

Every single one of these is (1) a fine-tune or specialized variant of an existing general model rather than something trained from scratch, (2) benchmarked on the same handful of security-specific evals — CyberGym above all, sometimes paired with something like CTI-REALM or ExploitGym — and (3) deliberately not shipped through the normal public API. Every lab picked the identical strategy: take the flagship, specialize it, gate it hard.

Why gate it at all

A model that's good at finding real vulnerabilities in real codebases is, by construction, also good at finding exploitable vulnerabilities to attack rather than patch. All three labs handle this the same way instead of pretending it isn't dual-use: restricted access (vetted teams, government/partner-only, or manual application review), and in Sakana's case, an explicit architectural checkpoint — a finding has to clear a human-in-the-loop verification step before it's treated as real. None of these ship as an open download or a self-serve API key.

What this says about where the race is heading

The interesting thing isn't that any one of these models is impressive — it's that "ship a hardened, gated, security-specialized variant of your flagship" has become a checklist item for a frontier lab in mid-2026, the same way "ship a reasoning mode" was a year earlier. Vulnerability discovery and patching at machine speed is becoming a capability labs compete on directly, not just a side effect of general intelligence. Worth watching whether the next wave brings this capability down-market to open-weight models, the way reasoning did — or whether "cyber" variants stay a permanently gated tier precisely because the safety story is genuinely different this time.

Update: the exception that maps the boundary

The same day this post ran, Cisco's Foundation AI team quietly released Antares — small (350M/1B) security models under Apache 2.0, fully open, downloadable, no gate. Does that break the pattern? Not really — it sharpens it. Antares does vulnerability localization: given an already-published CVE, it pinpoints which files in a codebase contain the flaw. It doesn't discover new vulnerabilities and it doesn't write exploits — which is exactly why Cisco could ship it open where OpenAI, Google, and Sakana all reached for a gate. The dividing line the industry is converging on isn't "security models are gated"; it's finding new holes stays gated, triaging known ones ships free. (The efficiency result is a story of its own: Antares-1B beats the 753B GLM-5.2 at this task, at roughly 1/170th of GPT-5.5's cost per evaluation run.)

Update — July 27, 2026: Microsoft ships a scoreboard

Six days later, Microsoft announced MAI-Cyber-1-Flash, and it does something none of the others did: it publishes the whole field on one axis.

A twelve-point gap. Every model in this post has been sitting in an 83–87% band; Microsoft's number is not in that band. But read the left column carefully, because the interesting claim isn't in the score — it's in the plus sign.

The product is the routing

MAI-Cyber-1-Flash is not a bigger model. It's a compact one, derived from the MAI-Thinking-1 lineage, and Microsoft is explicit that it was "designed to efficiently handle up to 90% of all tasks" so that MDASH can reserve GPT-5.4 for "the 10% of exceptionally hard tasks that truly need them." The 95.95% belongs to the routed system, not to the model.

Which means the headline result isn't "our cyber model is better than yours." It's "a cheap specialist plus a frontier escalation path beats either alone, and costs half as much." Microsoft claims a 50% cost saving against its own previous best MDASH configuration — GPT-5.4 + 5.4 mini + 5.3 codex — not against a competitor. They optimized against themselves.

That reframes the trend this post described. The first three labs treated "cyber" as a capability problem: take the flagship, specialize it, gate it. Microsoft is treating it as an economics problem. Their stated reason is worth quoting, because it's the part that generalizes: "given the enormous volume of inbound attacks, token cost is now the real constraint for defenders." Not capability. Cost.

That's a genuinely different bet, and it's the one Antares was hinting at from the other end. Cisco went small and open because triage is cheap work; Microsoft went small-and-routed because most security work is cheap work. Both are saying the frontier model is overkill for the bulk of the job — they just disagree about who should own the remaining 10%.

The moat is the data, and it isn't the model

Microsoft frames its advantage as three things — Model, Data, Harness — and is unusually direct that the middle one is the defensible one: 100 trillion daily security signals across identity, endpoint, cloud and network, the Microsoft Security Response Center's history of real exploits and their remediations, and telemetry from 1.6 million customers. They describe it as a live reinforcement learning loop, where actions connect to outcomes: what was exploitable, what was contained, what actually worked.

"No one can manufacture this history" is a strong claim, and mostly a fair one. It also implies the cyber-model race may not be winnable by model quality alone — which is an uncomfortable conclusion for labs whose only asset is the model.

What this does to the gating question

This post ended by asking whether "cyber" variants stay a permanently gated tier. Microsoft's answer is the most restrictive yet, and it arrives by a different route: MAI-Cyber-1-Flash isn't gated behind vetting like GPT-5.5-Cyber, or partner status like Gemini 3.5 Flash Cyber. It isn't really available as a model at all. You get it by buying MDASH, with tenant isolation, role-based controls, auditability and sandboxed execution with no internet access.

The dividing line from the Antares update still holds — finding new holes stays gated, triaging known ones ships free — but there's now a second axis. The unit being gated is drifting from the model to the system. Sakana gated an orchestrator. Google shipped through CodeMender. Microsoft is shipping a harness with 100+ agents and won't sell you the model inside it. For a capability this dual-use, the harness may simply be a better control surface than the weights: you can log it, sandbox it, and revoke it.

Which is a quietly significant development for anyone hoping this capability comes down-market the way reasoning did. Reasoning got cheap and open because it was a property of models. If cyber capability is turning into a property of systems, it may never have that moment.

Update — August 4, 2026: the other half of the boundary, and it's wide open

Every model in this post so far does offensive-capable work: find the vulnerability, write the exploit, or triage one someone else already found. Mistral's Shieldstral does a different security job — content safety classification, deciding whether a prompt, a response or an image violates a policy — and it maps the boundary this post has been tracing from the opposite side.

It ships Apache 2.0, 3B parameters, on a single 16GB GPU. No vetting, no partner status, no harness you have to buy. The most permissive release of anything in this post, by a wide margin.

The revealing part isn't Shieldstral itself, though — it's who it was benchmarked against:

Two security sub-fields, contemporaneous, and every serious entrant in one is gated while every serious entrant in the other is downloadable. OpenAI gates GPT-5.5-Cyber and open-weights GPT-OSS-Safeguard. Google gates Gemini 3.5 Flash Cyber and open-weights ShieldGemma. The same labs make opposite calls depending on which side of the line the capability falls.

That retires the question this post opened with. "Do cyber variants stay a permanently gated tier?" was the wrong question, because "cyber" was never one tier. The industry has sorted security tooling by dual-use potential with more discipline than it gets credit for: capability that can attack is gated; capability that can only defend is not merely open but competitively open, with half a dozen labs racing on the same benchmarks.

Two refinements to earlier updates in this post. First, the Antares line — finding new holes stays gated, triaging known ones ships free — generalizes further than vulnerability work: the real axis is offensive potential, and Antares was open because triage has none, not because it was small. Second, the Microsoft observation that the gated unit is drifting from model to system runs in reverse here. Defensive capability is drifting the other way, from system down to a droppable-in model. Shieldstral pushes hardest on that: its policy is a plain-language argument at inference rather than anything baked into the weights, so one checkpoint retargets to any deployment's rules.

There's an institutional signal too: Shieldstral shipped with Mistral as an inaugural member of the Open Secure AI Alliance, alongside NVIDIA and others. Defensive openness now has a consortium behind it rather than depending on each vendor's goodwill release by release — which is the sort of structure that makes a norm durable.

So the down-market question this post ended on has a two-sided answer. Offensive cyber capability didn't come down-market the way reasoning did, and on current evidence won't. Defensive capability already did — faster and more completely than reasoning ever managed, and it arrived free.

Update — August 7, 2026: the gate closes on an entire model, not a variant

Every update above was about a variant — a specialized fine-tune, spun off and gated while the flagship kept shipping normally. On August 7, OpenAI reported something categorically different: internal evaluations of Astra, an upcoming frontier model — not a cyber-specific spin-off of one — showed cyber and agentic-coding capability strong enough that OpenAI "cannot rule out" the Critical cybersecurity threshold under its own Preparedness Framework. Previous models, including GPT-5.6 Sol, evaluated at High. Astra is the first to put Critical in play at all.

Critical, under that framework, means a model that can identify and develop functional zero-day exploits across severity levels in hardened real-world critical systems without human help, or devise and execute end-to-end novel attack strategies against a hardened target given nothing but a high-level goal. That is a different kind of claim from anything else in this post. GPT-5.5-Cyber, Fugu-Cyber and Gemini 3.5 Flash Cyber are all specialized, gated variants sitting alongside a normally-available flagship. Astra is the flagship, and OpenAI is now restructuring how the model itself gets built — isolated testing environments, restricted network and tool access, weight encryption, sandboxed execution — and has paused internal work on Astra that doesn't yet meet those controls. The gate moved from "which model do we release" to "how do we allow this one to keep being trained."

One line in the disclosure is doing quiet, deliberate work: "Astra is an upcoming model, and was not involved in exploiting Hugging Face." OpenAI is answering a question before it's asked — pre-empting the read that this disclosure and the eval breach two and a half weeks earlier are the same story. They aren't, but the instinct to say so explicitly, unprompted, is itself informative about how closely the two are expected to be read together.

The Preparedness Framework has crossed a threshold like this once before: biology, June 2025, which OpenAI cites here as the precedent for the same playbook — strengthen safeguards, expand third-party testing, add security controls, keep shipping rather than stop. Universal chain-of-thought monitoring for risky or misaligned agentic behavior, government agencies and safety institutes brought in to test the capability directly, recommended security controls published for third-party testers. None of that is new machinery; it's the bio-threshold response, reused.

What is new is the category. Bio-Critical is about a model helping someone else cause harm outside the digital world. Cyber-Critical, in a model this capable at agentic coding, is a claim about a system that could autonomously act against other computer systems — including, per this post's own running thread, the kind of infrastructure two eval breaches already reached in the past three weeks by accident, under far weaker capability. The open question this post has been circling since July — does dual-use cyber capability come down-market, the way reasoning did — now has an upstream complication. The frontier itself may arrive gated at the model level, with the same lab drawing that line for the first time on its own flagship rather than on a spin-off it could afford to restrict.