# Astra's "Critical" cyber threshold, Mythos 5.1 and Gemini 3.8 Flash Cyber: one model, two safety tiers, and API access is now a spec-sheet line

> In 48 hours Anthropic, OpenAI and Google each shipped one model as two tiers: a public configuration with tighter cyber safeguards, and a restricted one for vetted organisations. Here is what the eleven official pages say about who qualifies, which tier ran the benchmark, and what a refusal looks like on your API.

- Published: Sep 3, 2026
- Author: Linden Kern, Chief Scientist
- Tags: models, providers, security
- Canonical: https://pirouter.ai/blog/one-model-two-safety-tiers

---
Between 1 September and 2 September, three frontier labs shipped the same product shape.
Anthropic released Claude Fable 5.1 and Claude Mythos 5.1 and said in the opening paragraph
that they "are the same model, but with different levels of safeguards." OpenAI said its
unreleased Astra is the first model it designates at the "Critical" cybersecurity threshold
of its Preparedness Framework, that Astra will be "available soon," and that "access to its
most advanced cybersecurity capabilities will be more limited." Google released Gemini 3.8
Flash for everyone and Gemini 3.8 Flash Cyber for "trusted defenders" through a new Fairwind
Program, describing the two as "powered by the same foundational intelligence." **So the
answer to the question in the title is this: OpenAI's Critical rating does not change what
you can call. It changes which configuration of the model answers when you do, and whether
you are eligible for the other one.** From this week, access tier is a line on the spec
sheet, next to context window and price.

This post reads the eleven official pages the three vendors published and draws four
consequences for anyone whose product sits on these APIs: a benchmark number now needs a
tier attached; eligibility is part of the capability you are buying; your router has to
treat the tier as a dimension; and the release-date rumours around the model some people
call GPT-6, a name OpenAI has not confirmed, are the least useful part of the week. Nothing
below is a measurement of ours. Where I do not know something, I will say so.

## Three vendors, 48 hours, one shape: Fable 5.1 vs Mythos 5.1, Astra vs Astra, Flash vs Flash Cyber

The table is the vendors' own words. I have not paraphrased the relationship column.

| | Anthropic | OpenAI | Google |
|---|---|---|---|
| General tier | Claude Fable 5.1, `claude-fable-5-1`, released 1 Sep | Astra, "available soon" | Gemini 3.8 Flash, released 2 Sep |
| Restricted tier | Claude Mythos 5.1, `claude-mythos-5-1` | Astra with Daybreak Blue access | Gemini 3.8 Flash Cyber |
| Relationship, verbatim | "the same model, but with different levels of safeguards" | "access to its most advanced cybersecurity capabilities will be more limited" | "powered by the same foundational intelligence" |
| Who gets the restricted tier | "trusted access programs" on the announcement; "Project Glasswing participants only" on the docs page; "currently … only available to a set of US organizations" | "a small group of alpha testers," then "access through Daybreak Blue expanding afterward" | Fairwind Program: "governments and national cyber authorities," "critical infrastructure operators," "core technology platforms" |
| Same price on both tiers? | ✓ $10 / $50 per million tokens on both docs pages | ⚠ No price published for either | ⚠ Flash at $0.75 / $3.75 until 31 Dec 2026; no public price for Flash Cyber |

**Anthropic** is the cleanest case because it says the quiet part in the first paragraph.
The [announcement](https://www.anthropic.com/claude-fable-and-mythos-5-1) states that Fable
5.1 "can now be used to discover software vulnerabilities—though not to develop exploits for
them," and that its safeguards "still redirect several kinds of dual-use cybersecurity tasks
… to our Opus models. This includes penetration testing, exploit generation, and
binary-based vulnerability scanning." Mythos 5.1 "is identical to Fable 5.1, but it offers
more permissive safeguards for vetted individuals and organizations." Two official pages
describe the gate in two ways. The announcement names a Cyber Verification Program and a Life
Sciences Verification Program; the [Mythos 5.1 docs
page](https://platform.claude.com/docs/en/models/mythos-5-1/overview) says "Invite only" and
"offered separately, by invitation only, as part of Project Glasswing," with access through
"your Anthropic, AWS, or Google Cloud account team." I am not going to reconcile those for
them. Both say the same operational thing: not self-serve.

**OpenAI** has been walking toward this since 7 August, when it wrote that it "cannot rule
out critical cyber capabilities" for Astra
([Responding to the next frontier of critical cyber capabilities](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/)).
On 1 September the hedge came off. The [Path to Astra](https://openai.com/index/path-to-astra/)
post gives the threshold in two conditions, either of which is sufficient:

> The model can identify and develop functional zero-day exploits of all severity levels in
> many hardened real-world critical systems without human intervention.
>
> The model can devise and execute end-to-end novel strategies for cyberattacks against
> hardened targets given only a high level desired goal.

GPT‑5.6 Sol, the current flagship, was assessed at High, one level below. The rollout plan
in OpenAI's words: "Advanced cybersecurity work will initially be available to a group of
testers, with access through Daybreak Blue following to expand defensive use." Daybreak Blue
was defined in a [10 August post](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/)
as "access to frontier general-purpose models, including GPT‑5.6 Sol, with safeguards
tailored to authorized defensive security work." There is also a third configuration hiding
in the 1 September text: "For accounts assessed as higher risk, we apply a more conservative
model-behavior boundary that refuses a broader range of potentially risky cyber assistance."
So the public Astra is not one tier either. It is a default boundary and a tighter one,
assigned per account by a process OpenAI does not describe. Everything in this paragraph is
according to OpenAI's post; the model has not shipped and there is no system card yet.

**Google** used different words, and the difference is worth respecting. The [3.8 Flash
launch post](https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/)
does not say "same model." It says both releases are "powered by the same foundational
intelligence," that 3.8 Flash "ships with safeguards against misuse in the domains of
Chemical, Biological, Radiological, and Nuclear (CBRN) and cyber offense," and that 3.8
Flash Cyber "ships with a more permissive set of mitigations for cybersecurity, and as such,
is only available to trusted defenders who require a more comprehensive set of cyber
capabilities." Google also says it "prioritized [vulnerability fixing] over offensive
capabilities like exploitation," which is a design statement the other two did not make. The
public Flash carries an introductory price with a footnote: "$0.75 per million input tokens
and $3.75 per million output tokens," expiring 31 December 2026, after which "$1.50/1M input
tokens and $7.50/1M output tokens will apply."

None of the three invented this on the spot. OpenAI had GPT‑5.6‑Cyber behind Daybreak Red in
August; Anthropic had Mythos 5 before Mythos 5.1; Google's own post compares Flash Cyber to
"3.5 Flash Cyber." What is new is that all three did it in the same 48 hours and wrote the
relationship between the tiers into the first paragraph. That is the moment a practice
becomes a spec-sheet line.

![Matrix of the three vendors' two-tier releases in September 2026: Anthropic's Fable 5.1 and Mythos 5.1, OpenAI's Astra and Astra with Daybreak Blue access, Google's Gemini 3.8 Flash and 3.8 Flash Cyber, each row showing the public tier, the restricted tier and the route to the restricted one](/blog/images/one-model-two-safety-tiers-tiers-matrix.png "The three releases side by side, in each vendor's own words. Read from the official pages on 2026-09-03.")

## Which tier ran the benchmark? Anthropic and OpenAI footnote it in opposite directions

This is the section I would read first if I were evaluating either model this month.

Anthropic publishes Terminal-Bench 4.0 at **55.8% for Fable 5.1 and 60.9% for Mythos 5.1**,
and the chart caption explains the gap in one sentence: "Claude Fable 5.1 and Claude Mythos
5.1 are the same underlying model; the gap between them reflects the tasks on which our
earlier, less precise cyber safeguards intervened." The footnote under the comparison table
goes further:

> Fable 5.1 was evaluated with its production safeguards enabled. On tasks where these
> safeguards intervened, Fable 5.1 and Fable 5 scored a zero on OSWorld 2.0, and Fable 5
> scored a zero on AutomationBench. In all other interventions from our safeguards,
> cybersecurity tasks were completed by Claude Opus 4.8, and biology tasks were completed by
> Claude Opus 5. This likely reduces the performance of Fable 5.1 and Fable 5 on these
> benchmarks.

Read that carefully. The public number is the public tier, safeguards on, with the tasks
the safeguards caught handed to an older model and counted against Fable 5.1. That is the
honest way to publish a general-availability score, and it means the 55.8% is a number your
API key can plausibly reproduce.

![Data card: Terminal-Bench 4.0, same underlying model, two tiers. Fable 5.1 with production safeguards on scores 55.8 percent; Mythos 5.1 under trusted access scores 60.9 percent. Anthropic attributes the gap to tasks where cyber safeguards intervened.](/blog/images/one-model-two-safety-tiers-benchmark.png "Same weights, two numbers. The 5.1-point gap is the safeguard tier, not the model. Source: [Introducing Claude Fable 5.1 and Claude Mythos 5.1](https://www.anthropic.com/claude-fable-and-mythos-5-1)")

OpenAI publishes the other tier. Astra "achieved a perfect score of 100%" on ExploitBench;
on an internal port of twenty recent V8 vulnerabilities it "achieves much higher arbitrary
code-execution rates than GPT‑5.6 Sol using far fewer output tokens," and during that
evaluation "even discovered and used two zero-day vulnerabilities as part of an exploit
chain." Then the sentence that most of the coverage skipped and [Tech
Times](https://www.techtimes.com/articles/326271/20260902/openai-astra-finds-zero-days-mid-benchmark-unasked-exploit-caps-access-vetted-defenders.htm)
did not:

> Astra results shown reflect capabilities with Daybreak Blue access, not the default
> production configuration.

So OpenAI's headline numbers describe the restricted tier, and the post tells you the public
configuration is not the thing that scored them. Anthropic's headline number describes the
public tier, and the footnote tells you the restricted tier scores higher. **Two footnotes
pointing in opposite directions, one conclusion: from now on a benchmark number without a
tier attached is incomplete.** The question to ask any model page, including ours, is "which
safeguards were on when this ran?"

Two things the footnotes cannot tell you. Anthropic says of the gap that "with the
improvements we're making to these safeguards today, we expect the difference between the
models to be much smaller," which is a forecast about the public tier's behaviour changing
under the same model ID. OpenAI says the system card, with "safety, security and alignment
testing and evaluations," arrives at launch, so the numbers above are a preview, and a
preview of a configuration you will not have. For Google, the [3.8 Flash model
card](https://deepmind.google/models/model-cards/gemini-3-8-flash/) concludes the public
model is "unlikely to reach any T/CCLs" under its Frontier Safety Framework; the CyberGym
and patching charts on the launch page belong to Flash Cyber, which is not in the public
catalogue. Same pattern, third vendor.

## Eligibility is now part of the capability: Project Glasswing, Daybreak Blue, Fairwind

A spec sheet used to describe the model. These three programmes describe the buyer. Here is
what each vendor says about who gets through, in the vendor's own words, because the
criteria are the product.

**Anthropic.** "Currently, it is only available to a set of US organizations, though we're
coordinating with the US government to expand access to a broader set of domestic and
international partners as quickly as possible." Two named programmes carry it, at different stages.
The Cyber Verification Program "currently provides access to certain Opus- and Sonnet-class
models with reduced cyber safeguards"; Mythos-class access arrives "in the near future." The
Life Sciences Verification Program is the one already running: "we have enrolled our first
participants." A cyber team applying to the CVP today qualifies for a tier below the one this
post is about. The docs route is your account team at Anthropic, AWS or Google Cloud. Four
dimensions, then: organisation, geography, purpose — and when.

**OpenAI.** The alpha group is described by a spokesperson, via
[Fortune](https://fortune.com/2026/09/01/openai-to-limit-release-of-its-asttra-model-astra-due-to-hacking-concerns/),
as "individuals and organizations that are responsible for protecting critical digital
infrastructure and, broadly, critical infrastructure," including the US government.
"OpenAI declined to name these organizations." [TechCrunch](https://techcrunch.com/2026/09/01/open-ais-astra-model-is-on-the-way-and-very-good-at-breaking-into-computer-systems/)
adds that the company "did not say who they were or how they would be chosen." After the
alpha comes Daybreak Blue. The [Daybreak partner page](https://openai.com/daybreak/partners/)
lists twenty companies for the defence network as a whole, from Akamai to Zscaler — that is the
programme's ecosystem, not a roster for this tier — and it carries one sentence every procurement
team should copy into its notes: "Submitting interest does not guarantee program inclusion, model
access, or a production timeline."

**Google.** The [Fairwind Program](https://blog.google/innovation-and-ai/technology/safety-security/fairwind-program/)
post lists three classes of organisation, claims "more than 650 participating partners
globally," and attaches operational conditions: participants "agree to strict operational
standards, including limiting access to employees within their internal cybersecurity,
incident response, or penetration testing teams and deploying protections like multi-factor
authentication." That last clause is the one to notice. It is a condition on *who inside
your company* may hold the key. Eligibility does not stop at the organisation boundary; it
reaches into your org chart.

Put the three side by side and the dimensions are the same: what kind of organisation you
are, where you are, what you intend to do, and how you were reached (an account team, an
application form, a staged rollout). None of these appear on a pricing page. All of them
now determine which configuration of the weights answers your request.

Last week's [Cursor loses OpenAI models on November 12](/blog/model-access-change-of-control)
asked whose contract your model is served under, and what happens to your access when the
intermediary changes hands. This week adds a second question underneath it: whose
*eligibility* was checked? If a restricted tier reaches you through a cloud marketplace
(Anthropic lists Bedrock, Google Cloud and Microsoft Foundry for Mythos 5.1) or through a
security vendor's product (the Daybreak page describes "managed services" in which "trained
partner teams remain hands-on-keyboard"), then the vetting that happened was theirs. Your
access to the tier is as durable as their standing in the programme, on top of the contract
clauses the previous post read.

## How the tier reaches your code: a 200 with `stop_reason: "refusal"` on one API, a stopped task on another

The most useful page of the eleven is the one nobody covered. Anthropic's [Refusals and
fallback](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback) docs
describe exactly what the public tier looks like from the caller's seat:

> Claude Fable 5.1, Claude Fable 5, and Claude Opus 5 include safety classifiers that can
> decline a request. When that happens, you receive a normal response, not an error, with
> `stop_reason: "refusal"`.

The example in the docs is the cyber category, and it is a successful HTTP 200:

```json
{
  "id": "msg_01XFUDYJgAACzvnptvVoYEL",
  "type": "message",
  "role": "assistant",
  "model": "claude-fable-5",
  "content": [],
  "stop_reason": "refusal",
  "stop_details": {
    "type": "refusal",
    "category": "cyber",
    "explanation": "This request was declined because it could enable cyber harm."
  },
  "usage": { "input_tokens": 412, "output_tokens": 0 }
}
```

The category table says of `"cyber"`: "The request could enable cyber harm, such as malware
or exploit development. Benign cybersecurity work can also trigger this category." Billing
is specific: a refusal before any output is not charged but "still counts against your rate
limits"; a mid-stream refusal "bills the input tokens and the output already streamed at
normal rates." And there is a fix, in beta: set `fallbacks` to `"default"` with the
`server-side-fallback-2026-07-01` header and "the API retries a declined request on the
fallback model Anthropic recommends for its refusal category." One more sentence from the
same page decides your architecture: server-side fallback "is not available on Amazon
Bedrock, Google Cloud, or Microsoft Foundry," nor on the Message Batches API. On those
surfaces the retry is yours.

The fix has a hole worth planning around, and the same page names it: "if a fallback model is
rate limited or overloaded, the fallback attempt is not made and the preceding refusal is
returned instead." The escape hatch depends on spare capacity on a second model, which is
exactly what you will not have during a burst. When that happens the response carries
`recommended_model`, naming a model to retry directly — so the fallback line in a procurement
table is a capacity question, not just a feature checkbox.

OpenAI describes the equivalent moment with less detail, because the model is not out. The
1 September post: "If the misalignment monitor pauses a task, users in ChatGPT or Codex may
be asked to review the action before continuing. When using other surfaces like the API,
the task will stop." It also warns that flagged work "can include work that does not appear
directly related to cybersecurity or tasks in which an agent is running for an extended
period." The same post gives the only official number for how often that gate closes: "on our
set of cyber jailbreak evaluations, Astra refuses 91.5% of requests (compared to 59% from
GPT‑5.6 Sol)." Read it as a rate, not a verdict — a stricter model is the point of the public
tier, and 91.5% on jailbreak attempts is also 8.5% getting through. If your product does
security work at all, that gap is the number to size a manual path against. Whether a stopped task is an error, a truncated stream, or a response with a
reason field is not stated; that is what the system card is for. I am not going to guess
the wire format.

Google's gate is one level up. Flash Cyber is not a model ID in the public catalogue; the
public 3.8 Flash carries the cyber-offense safeguards. I did not find a response-level
description of what a declined cyber request looks like on the Gemini API and I am not
going to invent one. The tier is enforced at the catalogue and the programme, not in the
JSON.

Three routing consequences follow, and none of them are exotic.

**1. Same name, different tier is now a normal condition.** `claude-fable-5-1` and
`claude-mythos-5-1` share every row of the docs comparison table: 1M context, 128K output,
$10 / $50, June 2026 cutoff. The only difference is the safeguard set and who may call it.
Astra's public and Daybreak Blue configurations share a name outright. Last month's
[ox-alpha vs deepseek-v4-flash](/blog/stealth-models-and-price-sheets) listed the fields a
router needs before a model enters a routing table. Add one: tier. A row that says "Fable
5.1" without saying which safeguards were on is as incomplete as a row without a price.

**2. A refusal is a 200.** A health check watching status codes will not see it. A cost
dashboard watching tokens will see zero output and a happy input count. The
[failover-signals post](/blog/failover-signals) found that nobody logs the faults that
return a good-looking response; a cyber refusal is the cleanest example of that class this
year, and it comes with a machine-readable reason. Read `stop_reason` on every response, not
just the ones that error.

**3. Cross-vendor fallback on a refusal is a policy decision, and the second vendor has a
tier too.** Anthropic's default fallback stays inside Anthropic: the category maps to a
recommended Claude model. If you decide a cyber refusal on Fable 5.1 should go to another
vendor's model, you are choosing a second public tier with its own boundary, its own
classifier and, for Astra, an as-yet-unpublished response shape. That is a decision to make
once per session, in the spirit of the [session-boundary argument](/blog/routers-arent-dead)
we made in August, not on each request. A mid-session refusal is a good reason to revisit it.

## What the tier label cannot tell you: six curl CVEs after a zero result

A tier label says what a configuration is permitted to attempt. It says nothing about what
it finds on your code. The week supplied a clean illustration, and it deserves to be read
with its caveats intact.

On 24 August, curl's maintainer Daniel Stenberg wrote that "[Anthropic] Mythos says it can't
find any more. … [OpenAI] Codex security shows an empty list," as quoted in
[AISLE's post](https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero).
AISLE then ran its own system against the same codebase, filed 29 reports, and curl's
security team accepted six as CVEs in curl 8.22.0. All six are rated Low. AISLE's own
framing of why this comparison is unusually clean: "the baseline was public and timestamped
before our result existed."

Precision about the object matters here, because the headline invites a misreading. The
zero came from Mythos, which is the *restricted* tier, and from Codex Security, which is a
product. This is not "the public model missed six bugs." It is: the configuration with the
most permissive cyber safeguards on offer reported nothing on one heavily audited codebase
that week, and a system built on smaller models reported 29 things of which six held up as
low-severity CVEs.

The [Hacker News thread](https://news.ycombinator.com/item?id=49536114) raised the objections I would raise.
`_pdp_`: "you cannot compare a model with a specialised harness." `markasoftware` asked whether
AISLE is simply tuned for a higher false-positive rate, and `goobreee` replied with Stenberg's
own May post, in which Mythos reported five issues on curl: one real low-severity CVE, three
false positives, one "just a bug." Both objections are fair, and I am not drawing a ranking
from one codebase and six Low CVEs.

What I am drawing is narrower. "Restricted tier" is an *eligibility* claim: this
configuration is allowed to do exploit development, and you are or are not allowed to ask
it. It is not a *results* claim about your repository. The only number that answers "what
does this find on our code" is the one you produce yourself, on your code, with the
safeguards you will actually have. That was true before this week; the tiers just make it
impossible to pretend otherwise.

## The hype layer and the official record: GPT-6 is a name OpenAI has not confirmed

Because Astra is unreleased, there is a second body of "information" about it that deserves
to be separated from the first. Here is the official record, dated.

| Date | What OpenAI said | Where |
|---|---|---|
| 7 August | "we cannot rule out critical cyber capabilities" | [Responding to the next frontier](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/) |
| 28 August | "we restarted the large frontier RL run that was previously paused" | [Path to Astra](https://openai.com/index/path-to-astra/) |
| 1 September | "We now believe Astra meets the Critical cybersecurity capability threshold"; "We plan to make Astra available soon" | Path to Astra |
| 1 September | Release "delayed a certain number of weeks because everything was paused after Hugging Face" | Spokesperson, via [Fortune](https://fortune.com/2026/09/01/openai-to-limit-release-of-its-asttra-model-astra-due-to-hacking-concerns/) |
| 1 September | No release timeline provided | [The Verge](https://www.theverge.com/ai-artificial-intelligence/987695/openai-astra-unreleased-model-cybersecurity-delay) |

And here is the other layer, all of it unverified, all of it reaching me through at least
one intermediary:

- On 29 August `@Lentils80` posted what it called outputs from an Astra checkpoint labelled
  "mozaik-alpha-fdm." [testingcatalog](https://www.testingcatalog.com/first-outputs-from-gpt-6-astra-model-from-openai/)
  relayed it and, to its credit, added: "OpenAI has not announced a release date or confirmed
  that 'mozaik-alpha-fdm' is an official codename." OpenAI has not responded.
- On 25 August `@synthwavedd` claimed a finished pretrain codenamed "Bel" at more than ten
  trillion parameters. [felloai's roundup](https://felloai.com/all-we-know-about-chatgpt-6/) notes
  it "traces to a single X account and remains unverified," and that some republications swapped
  the codenames. I am citing a roundup citing a post.
- The name. The Information reported on 31 July that OpenAI had not decided whether Astra
  ships as GPT-6, as a GPT-5 point release, or as a separate class; I read that through
  [Gizmodo](https://gizmodo.com/openai-smuggled-the-announcement-of-astra-its-next-ai-model-into-a-blog-post-about-math-2000793689)
  and felloai, not the original. testingcatalog's own line is the fair one: "GPT-6 remains a
  plausible public name, but OpenAI has given no indication that it has chosen this
  branding." Every official page above says "Astra." So will this post.

The rumour layer is here only to say why it does not matter. A checkpoint label and a parameter
count, even if true, tell you nothing about which tier your key lands on, what a refusal looks
like, or whether you qualify for the configuration that scored 100% on ExploitBench. The official
record answers all three, to the extent OpenAI has decided them. The rest is a date nobody has,
for a name nobody has picked.

## Four lines to add to your procurement table

Each of these is a column you can fill today, from the pages linked above, for the models
you already use.

1. **Benchmark tier.** Next to every score: which tier, safeguards on or off, and what
   happened to intercepted tasks. Anthropic's footnote and OpenAI's one-line disclaimer are
   both usable templates; a vendor page that has neither is a page with a gap.
2. **Eligibility.** Organisation type, geography, permitted purpose, and the route in
   (account team, application, partner programme). One row per model, per tier. Date it:
   Anthropic says it is "coordinating with the US government to expand access," Google says
   Fairwind "will evolve," OpenAI calls Daybreak "a controlled rollout." All three rows will
   change.
3. **Refusal shape and fallback support, per platform.** Is a refusal an error or a 200
   with a reason? Does it count against rate limits? Is server-side fallback available where
   you call from? For Anthropic today the answers are: a 200, yes, and only on the Claude
   API in beta. For Astra: not yet published. For Gemini: the gate is the catalogue.
4. **Tier-change notice.** The previous post's fourth question was whether "access"
   includes models released after signing. Add: does the public tier's *behaviour* change
   under the same model ID? Anthropic has already told you it will ("we expect the
   difference between the models to be much smaller"); OpenAI says it will "keep
   calibrating these safeguards." Both are good news for users and both are changes to what
   your model ID does with no version bump. Snapshot your refusal rate on your own eval set
   now, so you can see it move.

One sentence on us, since we build a router: a router that treats tier and region as
routing dimensions is designed to hold these four columns next to the price, so that a
`stop_reason` of `refusal` is a routing event and not a support ticket. That is a design
description, not a shipping claim, and the [failover-signals post](/blog/failover-signals)
covers what any gateway can and cannot see. If you are also weighing Fable 5.1 on cost, the
same week's [cache-read repricing](/blog/fable-5-1-cache-read-crossover) applies to both
tiers, because the docs list identical prices.

## One model, two doors

For most of a decade the unit a lab shipped was a model: weights, a name, a price. Last
month we argued in [Qwen3.8-27B: seven endpoints, one name, two prices](/blog/one-weight-many-prices)
that the unit had already become a tuple of weights, quantization, context window and
version, and that a router keyed on the name alone was routing blind. This week the tuple
grew a field that is not about the model at all. It is about you: who you are, where you
are, what you intend to do.

That is a genuine change in what "a model" means as a purchasable thing, and I do not think
it reverses. The capability that triggered it, autonomous discovery and exploitation of
unknown vulnerabilities in hardened systems, is the kind that gets more common with each
generation, not less, and all three vendors have now built the machinery to gate it. The
gate will move; Anthropic has said the public tier's gap will shrink, OpenAI has said access
will widen through Daybreak. But a gate that moves is still a gate, and it still needs a
column.

The eval says 60.9 or 55.8. What it cannot tell you is which of those two numbers your key
will produce, because that depends on a door you may not be able to open, and on a door the
vendor may quietly widen next quarter. Write down which door you came through. It is the one
line on the spec sheet you cannot read off the model ID, and from this week it is the line
that decides what the model ID does.

---

## Sources

### anthropic.com

- [announcement](https://www.anthropic.com/claude-fable-and-mythos-5-1)

### platform.claude.com

- [Mythos 5.1 docs page](https://platform.claude.com/docs/en/models/mythos-5-1/overview)
- [Refusals and fallback](https://platform.claude.com/docs/en/build-with-claude/refusals-and-fallback)

### openai.com

- [Responding to the next frontier of critical cyber capabilities](https://openai.com/index/responding-next-frontier-critical-cyber-capabilities/)
- [Path to Astra](https://openai.com/index/path-to-astra/)
- [10 August post](https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/)
- [Daybreak partner page](https://openai.com/daybreak/partners/)

### blog.google

- [3.8 Flash launch post](https://blog.google/innovation-and-ai/models-and-research/gemini-models/3-8-flash-and-3-8-flash-cyber/)
- [Fairwind Program](https://blog.google/innovation-and-ai/technology/safety-security/fairwind-program/)

### techtimes.com

- [Tech Times](https://www.techtimes.com/articles/326271/20260902/openai-astra-finds-zero-days-mid-benchmark-unasked-exploit-caps-access-vetted-defenders.htm)

### deepmind.google

- [3.8 Flash model card](https://deepmind.google/models/model-cards/gemini-3-8-flash/)

### fortune.com

- [Fortune](https://fortune.com/2026/09/01/openai-to-limit-release-of-its-asttra-model-astra-due-to-hacking-concerns/)

### techcrunch.com

- [TechCrunch](https://techcrunch.com/2026/09/01/open-ais-astra-model-is-on-the-way-and-very-good-at-breaking-into-computer-systems/)

### aisle.com

- [AISLE's post](https://aisle.com/blog/aisle-discovered-six-curl-cves-after-openai-and-anthropic-found-zero)

### news.ycombinator.com

- [Hacker News thread](https://news.ycombinator.com/item?id=49536114)

### theverge.com

- [The Verge](https://www.theverge.com/ai-artificial-intelligence/987695/openai-astra-unreleased-model-cybersecurity-delay)

### testingcatalog.com

- [testingcatalog](https://www.testingcatalog.com/first-outputs-from-gpt-6-astra-model-from-openai/)

### felloai.com

- [felloai's roundup](https://felloai.com/all-we-know-about-chatgpt-6/)

### gizmodo.com

- [Gizmodo](https://gizmodo.com/openai-smuggled-the-announcement-of-astra-its-next-ai-model-into-a-blog-post-about-math-2000793689)