Astra's "Critical" cyber threshold, Mythos 5.1 and Gemini 3.8 Flash Cyber: one model, two safety tiers, and API access is now a spec-sheet line

Between 1 September and 2 September, three frontier labs shipped the same product shape. Anthropic released Claude Fable 5.1 and Claude Mythos 5.1 and said in the opening paragraph that they “are the same model, but with different levels of safeguards.” OpenAI said its unreleased Astra is the first model it designates at the “Critical” cybersecurity threshold of its Preparedness Framework, that Astra will be “available soon,” and that “access to its most advanced cybersecurity capabilities will be more limited.” Google released Gemini 3.8 Flash for everyone and Gemini 3.8 Flash Cyber for “trusted defenders” through a new Fairwind Program, describing the two as “powered by the same foundational intelligence.” So the answer to the question in the title is this: OpenAI’s Critical rating does not change what you can call. It changes which configuration of the model answers when you do, and whether you are eligible for the other one. From this week, access tier is a line on the spec sheet, next to context window and price.

This post reads the eleven official pages the three vendors published and draws four consequences for anyone whose product sits on these APIs: a benchmark number now needs a tier attached; eligibility is part of the capability you are buying; your router has to treat the tier as a dimension; and the release-date rumours around the model some people call GPT-6, a name OpenAI has not confirmed, are the least useful part of the week. Nothing below is a measurement of ours. Where I do not know something, I will say so.

Three vendors, 48 hours, one shape: Fable 5.1 vs Mythos 5.1, Astra vs Astra, Flash vs Flash Cyber

The table is the vendors’ own words. I have not paraphrased the relationship column.

Anthropic is the cleanest case because it says the quiet part in the first paragraph. The announcement states that Fable 5.1 “can now be used to discover software vulnerabilities—though not to develop exploits for them,” and that its safeguards “still redirect several kinds of dual-use cybersecurity tasks … to our Opus models. This includes penetration testing, exploit generation, and binary-based vulnerability scanning.” Mythos 5.1 “is identical to Fable 5.1, but it offers more permissive safeguards for vetted individuals and organizations.” Two official pages describe the gate in two ways. The announcement names a Cyber Verification Program and a Life Sciences Verification Program; the Mythos 5.1 docs page says “Invite only” and “offered separately, by invitation only, as part of Project Glasswing,” with access through “your Anthropic, AWS, or Google Cloud account team.” I am not going to reconcile those for them. Both say the same operational thing: not self-serve.

OpenAI has been walking toward this since 7 August, when it wrote that it “cannot rule out critical cyber capabilities” for Astra (Responding to the next frontier of critical cyber capabilities). On 1 September the hedge came off. The Path to Astra post gives the threshold in two conditions, either of which is sufficient:

The model can identify and develop functional zero-day exploits of all severity levels in many hardened real-world critical systems without human intervention.

The model can devise and execute end-to-end novel strategies for cyberattacks against hardened targets given only a high level desired goal.

GPT‑5.6 Sol, the current flagship, was assessed at High, one level below. The rollout plan in OpenAI’s words: “Advanced cybersecurity work will initially be available to a group of testers, with access through Daybreak Blue following to expand defensive use.” Daybreak Blue was defined in a 10 August post as “access to frontier general-purpose models, including GPT‑5.6 Sol, with safeguards tailored to authorized defensive security work.” There is also a third configuration hiding in the 1 September text: “For accounts assessed as higher risk, we apply a more conservative model-behavior boundary that refuses a broader range of potentially risky cyber assistance.” So the public Astra is not one tier either. It is a default boundary and a tighter one, assigned per account by a process OpenAI does not describe. Everything in this paragraph is according to OpenAI’s post; the model has not shipped and there is no system card yet.

Google used different words, and the difference is worth respecting. The 3.8 Flash launch post does not say “same model.” It says both releases are “powered by the same foundational intelligence,” that 3.8 Flash “ships with safeguards against misuse in the domains of Chemical, Biological, Radiological, and Nuclear (CBRN) and cyber offense,” and that 3.8 Flash Cyber “ships with a more permissive set of mitigations for cybersecurity, and as such, is only available to trusted defenders who require a more comprehensive set of cyber capabilities.” Google also says it “prioritized [vulnerability fixing] over offensive capabilities like exploitation,” which is a design statement the other two did not make. The public Flash carries an introductory price with a footnote: “$0.75 per million input tokens and $3.75 per million output tokens,” expiring 31 December 2026, after which “$1.50/1M input tokens and $7.50/1M output tokens will apply.”

None of the three invented this on the spot. OpenAI had GPT‑5.6‑Cyber behind Daybreak Red in August; Anthropic had Mythos 5 before Mythos 5.1; Google’s own post compares Flash Cyber to “3.5 Flash Cyber.” What is new is that all three did it in the same 48 hours and wrote the relationship between the tiers into the first paragraph. That is the moment a practice becomes a spec-sheet line.

Which tier ran the benchmark? Anthropic and OpenAI footnote it in opposite directions

This is the section I would read first if I were evaluating either model this month.

Anthropic publishes Terminal-Bench 4.0 at 55.8% for Fable 5.1 and 60.9% for Mythos 5.1, and the chart caption explains the gap in one sentence: “Claude Fable 5.1 and Claude Mythos 5.1 are the same underlying model; the gap between them reflects the tasks on which our earlier, less precise cyber safeguards intervened.” The footnote under the comparison table goes further:

Fable 5.1 was evaluated with its production safeguards enabled. On tasks where these safeguards intervened, Fable 5.1 and Fable 5 scored a zero on OSWorld 2.0, and Fable 5 scored a zero on AutomationBench. In all other interventions from our safeguards, cybersecurity tasks were completed by Claude Opus 4.8, and biology tasks were completed by Claude Opus 5. This likely reduces the performance of Fable 5.1 and Fable 5 on these benchmarks.

Read that carefully. The public number is the public tier, safeguards on, with the tasks the safeguards caught handed to an older model and counted against Fable 5.1. That is the honest way to publish a general-availability score, and it means the 55.8% is a number your API key can plausibly reproduce.

OpenAI publishes the other tier. Astra “achieved a perfect score of 100%” on ExploitBench; on an internal port of twenty recent V8 vulnerabilities it “achieves much higher arbitrary code-execution rates than GPT‑5.6 Sol using far fewer output tokens,” and during that evaluation “even discovered and used two zero-day vulnerabilities as part of an exploit chain.” Then the sentence that most of the coverage skipped and Tech Times did not:

Astra results shown reflect capabilities with Daybreak Blue access, not the default production configuration.

So OpenAI’s headline numbers describe the restricted tier, and the post tells you the public configuration is not the thing that scored them. Anthropic’s headline number describes the public tier, and the footnote tells you the restricted tier scores higher. Two footnotes pointing in opposite directions, one conclusion: from now on a benchmark number without a tier attached is incomplete. The question to ask any model page, including ours, is “which safeguards were on when this ran?”

Two things the footnotes cannot tell you. Anthropic says of the gap that “with the improvements we’re making to these safeguards today, we expect the difference between the models to be much smaller,” which is a forecast about the public tier’s behaviour changing under the same model ID. OpenAI says the system card, with “safety, security and alignment testing and evaluations,” arrives at launch, so the numbers above are a preview, and a preview of a configuration you will not have. For Google, the 3.8 Flash model card concludes the public model is “unlikely to reach any T/CCLs” under its Frontier Safety Framework; the CyberGym and patching charts on the launch page belong to Flash Cyber, which is not in the public catalogue. Same pattern, third vendor.

Eligibility is now part of the capability: Project Glasswing, Daybreak Blue, Fairwind

A spec sheet used to describe the model. These three programmes describe the buyer. Here is what each vendor says about who gets through, in the vendor’s own words, because the criteria are the product.

Anthropic. “Currently, it is only available to a set of US organizations, though we’re coordinating with the US government to expand access to a broader set of domestic and international partners as quickly as possible.” Two named programmes carry it, at different stages. The Cyber Verification Program “currently provides access to certain Opus- and Sonnet-class models with reduced cyber safeguards”; Mythos-class access arrives “in the near future.” The Life Sciences Verification Program is the one already running: “we have enrolled our first participants.” A cyber team applying to the CVP today qualifies for a tier below the one this post is about. The docs route is your account team at Anthropic, AWS or Google Cloud. Four dimensions, then: organisation, geography, purpose — and when.

OpenAI. The alpha group is described by a spokesperson, via Fortune, as “individuals and organizations that are responsible for protecting critical digital infrastructure and, broadly, critical infrastructure,” including the US government. “OpenAI declined to name these organizations.” TechCrunch adds that the company “did not say who they were or how they would be chosen.” After the alpha comes Daybreak Blue. The Daybreak partner page lists twenty companies for the defence network as a whole, from Akamai to Zscaler — that is the programme’s ecosystem, not a roster for this tier — and it carries one sentence every procurement team should copy into its notes: “Submitting interest does not guarantee program inclusion, model access, or a production timeline.”

Google. The Fairwind Program post lists three classes of organisation, claims “more than 650 participating partners globally,” and attaches operational conditions: participants “agree to strict operational standards, including limiting access to employees within their internal cybersecurity, incident response, or penetration testing teams and deploying protections like multi-factor authentication.” That last clause is the one to notice. It is a condition on who inside your company may hold the key. Eligibility does not stop at the organisation boundary; it reaches into your org chart.

Put the three side by side and the dimensions are the same: what kind of organisation you are, where you are, what you intend to do, and how you were reached (an account team, an application form, a staged rollout). None of these appear on a pricing page. All of them now determine which configuration of the weights answers your request.

Last week’s Cursor loses OpenAI models on November 12 asked whose contract your model is served under, and what happens to your access when the intermediary changes hands. This week adds a second question underneath it: whose eligibility was checked? If a restricted tier reaches you through a cloud marketplace (Anthropic lists Bedrock, Google Cloud and Microsoft Foundry for Mythos 5.1) or through a security vendor’s product (the Daybreak page describes “managed services” in which “trained partner teams remain hands-on-keyboard”), then the vetting that happened was theirs. Your access to the tier is as durable as their standing in the programme, on top of the contract clauses the previous post read.

How the tier reaches your code: a 200 with stop_reason: "refusal" on one API, a stopped task on another

The most useful page of the eleven is the one nobody covered. Anthropic’s Refusals and fallback docs describe exactly what the public tier looks like from the caller’s seat:

Claude Fable 5.1, Claude Fable 5, and Claude Opus 5 include safety classifiers that can decline a request. When that happens, you receive a normal response, not an error, with stop_reason: "refusal".

The example in the docs is the cyber category, and it is a successful HTTP 200:

{
  "id": "msg_01XFUDYJgAACzvnptvVoYEL",
  "type": "message",
  "role": "assistant",
  "model": "claude-fable-5",
  "content": [],
  "stop_reason": "refusal",
  "stop_details": {
    "type": "refusal",
    "category": "cyber",
    "explanation": "This request was declined because it could enable cyber harm."
  },
  "usage": { "input_tokens": 412, "output_tokens": 0 }
}

The category table says of "cyber": “The request could enable cyber harm, such as malware or exploit development. Benign cybersecurity work can also trigger this category.” Billing is specific: a refusal before any output is not charged but “still counts against your rate limits”; a mid-stream refusal “bills the input tokens and the output already streamed at normal rates.” And there is a fix, in beta: set fallbacks to "default" with the server-side-fallback-2026-07-01 header and “the API retries a declined request on the fallback model Anthropic recommends for its refusal category.” One more sentence from the same page decides your architecture: server-side fallback “is not available on Amazon Bedrock, Google Cloud, or Microsoft Foundry,” nor on the Message Batches API. On those surfaces the retry is yours.

The fix has a hole worth planning around, and the same page names it: “if a fallback model is rate limited or overloaded, the fallback attempt is not made and the preceding refusal is returned instead.” The escape hatch depends on spare capacity on a second model, which is exactly what you will not have during a burst. When that happens the response carries recommended_model, naming a model to retry directly — so the fallback line in a procurement table is a capacity question, not just a feature checkbox.

OpenAI describes the equivalent moment with less detail, because the model is not out. The 1 September post: “If the misalignment monitor pauses a task, users in ChatGPT or Codex may be asked to review the action before continuing. When using other surfaces like the API, the task will stop.” It also warns that flagged work “can include work that does not appear directly related to cybersecurity or tasks in which an agent is running for an extended period.” The same post gives the only official number for how often that gate closes: “on our set of cyber jailbreak evaluations, Astra refuses 91.5% of requests (compared to 59% from GPT‑5.6 Sol).” Read it as a rate, not a verdict — a stricter model is the point of the public tier, and 91.5% on jailbreak attempts is also 8.5% getting through. If your product does security work at all, that gap is the number to size a manual path against. Whether a stopped task is an error, a truncated stream, or a response with a reason field is not stated; that is what the system card is for. I am not going to guess the wire format.

Google’s gate is one level up. Flash Cyber is not a model ID in the public catalogue; the public 3.8 Flash carries the cyber-offense safeguards. I did not find a response-level description of what a declined cyber request looks like on the Gemini API and I am not going to invent one. The tier is enforced at the catalogue and the programme, not in the JSON.

Three routing consequences follow, and none of them are exotic.

1. Same name, different tier is now a normal condition. claude-fable-5-1 and claude-mythos-5-1 share every row of the docs comparison table: 1M context, 128K output, $10 / $50, June 2026 cutoff. The only difference is the safeguard set and who may call it. Astra’s public and Daybreak Blue configurations share a name outright. Last month’s ox-alpha vs deepseek-v4-flash listed the fields a router needs before a model enters a routing table. Add one: tier. A row that says “Fable 5.1” without saying which safeguards were on is as incomplete as a row without a price.

2. A refusal is a 200. A health check watching status codes will not see it. A cost dashboard watching tokens will see zero output and a happy input count. The failover-signals post found that nobody logs the faults that return a good-looking response; a cyber refusal is the cleanest example of that class this year, and it comes with a machine-readable reason. Read stop_reason on every response, not just the ones that error.

3. Cross-vendor fallback on a refusal is a policy decision, and the second vendor has a tier too. Anthropic’s default fallback stays inside Anthropic: the category maps to a recommended Claude model. If you decide a cyber refusal on Fable 5.1 should go to another vendor’s model, you are choosing a second public tier with its own boundary, its own classifier and, for Astra, an as-yet-unpublished response shape. That is a decision to make once per session, in the spirit of the session-boundary argument we made in August, not on each request. A mid-session refusal is a good reason to revisit it.

What the tier label cannot tell you: six curl CVEs after a zero result

A tier label says what a configuration is permitted to attempt. It says nothing about what it finds on your code. The week supplied a clean illustration, and it deserves to be read with its caveats intact.

On 24 August, curl’s maintainer Daniel Stenberg wrote that “[Anthropic] Mythos says it can’t find any more. … [OpenAI] Codex security shows an empty list,” as quoted in AISLE’s post. AISLE then ran its own system against the same codebase, filed 29 reports, and curl’s security team accepted six as CVEs in curl 8.22.0. All six are rated Low. AISLE’s own framing of why this comparison is unusually clean: “the baseline was public and timestamped before our result existed.”

Precision about the object matters here, because the headline invites a misreading. The zero came from Mythos, which is the restricted tier, and from Codex Security, which is a product. This is not “the public model missed six bugs.” It is: the configuration with the most permissive cyber safeguards on offer reported nothing on one heavily audited codebase that week, and a system built on smaller models reported 29 things of which six held up as low-severity CVEs.

The Hacker News thread raised the objections I would raise. _pdp_: “you cannot compare a model with a specialised harness.” markasoftware asked whether AISLE is simply tuned for a higher false-positive rate, and goobreee replied with Stenberg’s own May post, in which Mythos reported five issues on curl: one real low-severity CVE, three false positives, one “just a bug.” Both objections are fair, and I am not drawing a ranking from one codebase and six Low CVEs.

What I am drawing is narrower. “Restricted tier” is an eligibility claim: this configuration is allowed to do exploit development, and you are or are not allowed to ask it. It is not a results claim about your repository. The only number that answers “what does this find on our code” is the one you produce yourself, on your code, with the safeguards you will actually have. That was true before this week; the tiers just make it impossible to pretend otherwise.

The hype layer and the official record: GPT-6 is a name OpenAI has not confirmed

Because Astra is unreleased, there is a second body of “information” about it that deserves to be separated from the first. Here is the official record, dated.

And here is the other layer, all of it unverified, all of it reaching me through at least one intermediary:

• On 29 August @Lentils80 posted what it called outputs from an Astra checkpoint labelled “mozaik-alpha-fdm.” testingcatalog relayed it and, to its credit, added: “OpenAI has not announced a release date or confirmed that ‘mozaik-alpha-fdm’ is an official codename.” OpenAI has not responded.
• On 25 August @synthwavedd claimed a finished pretrain codenamed “Bel” at more than ten trillion parameters. felloai’s roundup notes it “traces to a single X account and remains unverified,” and that some republications swapped the codenames. I am citing a roundup citing a post.
• The name. The Information reported on 31 July that OpenAI had not decided whether Astra ships as GPT-6, as a GPT-5 point release, or as a separate class; I read that through Gizmodo and felloai, not the original. testingcatalog’s own line is the fair one: “GPT-6 remains a plausible public name, but OpenAI has given no indication that it has chosen this branding.” Every official page above says “Astra.” So will this post.

The rumour layer is here only to say why it does not matter. A checkpoint label and a parameter count, even if true, tell you nothing about which tier your key lands on, what a refusal looks like, or whether you qualify for the configuration that scored 100% on ExploitBench. The official record answers all three, to the extent OpenAI has decided them. The rest is a date nobody has, for a name nobody has picked.

Four lines to add to your procurement table

Each of these is a column you can fill today, from the pages linked above, for the models you already use.

1. Benchmark tier. Next to every score: which tier, safeguards on or off, and what happened to intercepted tasks. Anthropic’s footnote and OpenAI’s one-line disclaimer are both usable templates; a vendor page that has neither is a page with a gap.
2. Eligibility. Organisation type, geography, permitted purpose, and the route in (account team, application, partner programme). One row per model, per tier. Date it: Anthropic says it is “coordinating with the US government to expand access,” Google says Fairwind “will evolve,” OpenAI calls Daybreak “a controlled rollout.” All three rows will change.
3. Refusal shape and fallback support, per platform. Is a refusal an error or a 200 with a reason? Does it count against rate limits? Is server-side fallback available where you call from? For Anthropic today the answers are: a 200, yes, and only on the Claude API in beta. For Astra: not yet published. For Gemini: the gate is the catalogue.
4. Tier-change notice. The previous post’s fourth question was whether “access” includes models released after signing. Add: does the public tier’s behaviour change under the same model ID? Anthropic has already told you it will (“we expect the difference between the models to be much smaller”); OpenAI says it will “keep calibrating these safeguards.” Both are good news for users and both are changes to what your model ID does with no version bump. Snapshot your refusal rate on your own eval set now, so you can see it move.

One sentence on us, since we build a router: a router that treats tier and region as routing dimensions is designed to hold these four columns next to the price, so that a stop_reason of refusal is a routing event and not a support ticket. That is a design description, not a shipping claim, and the failover-signals post covers what any gateway can and cannot see. If you are also weighing Fable 5.1 on cost, the same week’s cache-read repricing applies to both tiers, because the docs list identical prices.

One model, two doors

For most of a decade the unit a lab shipped was a model: weights, a name, a price. Last month we argued in Qwen3.8-27B: seven endpoints, one name, two prices that the unit had already become a tuple of weights, quantization, context window and version, and that a router keyed on the name alone was routing blind. This week the tuple grew a field that is not about the model at all. It is about you: who you are, where you are, what you intend to do.

That is a genuine change in what “a model” means as a purchasable thing, and I do not think it reverses. The capability that triggered it, autonomous discovery and exploitation of unknown vulnerabilities in hardened systems, is the kind that gets more common with each generation, not less, and all three vendors have now built the machinery to gate it. The gate will move; Anthropic has said the public tier’s gap will shrink, OpenAI has said access will widen through Daybreak. But a gate that moves is still a gate, and it still needs a column.

The eval says 60.9 or 55.8. What it cannot tell you is which of those two numbers your key will produce, because that depends on a door you may not be able to open, and on a door the vendor may quietly widen next quarter. Write down which door you came through. It is the one line on the spec sheet you cannot read off the model ID, and from this week it is the line that decides what the model ID does.