Gated AI Models: Who Gets Gemini 4 Carbon and GPT-6 Rosalind

Within three days at the end of October 2026, two frontier labs announced models that most of their customers cannot use. Google introduced Gemini 4 Carbon on October 28 and said it would go first to a subset of cyber defenders through its Fairwind Program. OpenAI's enterprise release notes for October 30 recorded GPT-6 Rosalind Research rolling out to a limited set of approved customers for life-sciences work. Both join Anthropic's Claude Mythos 5.1, which since September 1 has been limited to vetted organisations through Anthropic's trusted-access programmes.

Gating is not new; research previews and waitlists have existed for years. What stands out is that Google and Anthropic are withholding models they describe as their strongest, published with benchmark results and prices, and OpenAI its newest life-sciences model, all kept from general sale on purpose. For a business that buys AI by the token, the question is practical: can we get this, how, and if not, what does the gate tell us about the model we can buy?

This post answers from the vendors' own pages only: Google's announcement and Fairwind programme page, OpenAI's release notes and GPT-Rosalind help article, and Anthropic's launch post for Fable 5.1 and Mythos 5.1. It does not guess at release dates the vendors have not given, and it does not describe capabilities beyond the vendors' own claims, which are labelled as such.

The three announcements share a structure. Each lab names a capability it considers dual-use, cyber offence in two cases and advanced biology in the other, and each ships the model that is strongest at that capability only to organisations whose work it can verify. Each also tells everyone else what to use in the meantime: Google points to Gemini 4 Argon and its CodeMender security agent, OpenAI to GPT-5.5 Rosalind Research for existing approved users, and Anthropic to Fable 5.1 with its standard safeguards.

The practical consequence for buyers is that "the best model" and "the best model you can buy" have separated. A procurement team comparing vendors on headline benchmarks is now, in part, comparing models it cannot license. Google's Carbon post, for example, reports a first place on the Artificial Analysis Intelligence Index at 59 and a score of 88.2% on SEC-bench Pro; both are vendor-reported, and neither can be reproduced by a customer who cannot get the model. The number that matters to most readers is the one for the sibling they can actually run.

A failure case worth naming early: a team that reads "Gemini 4 Carbon launches at $2 per million input tokens" and budgets for it. The price is real and published, but it attaches to a model that Google says is coming to developers, businesses and consumers "as soon as possible" with no date given. Budget for Argon, which Google states carries the same introductory price, and treat Carbon as upside.

Google's October 28, 2026 announcement, bylined by Koray Kavukcuoglu, describes Carbon as its strongest model with state-of-the-art cybersecurity and long-horizon capabilities. The rollout paragraph is the operative one. Google says it is taking a deliberate approach, is engaged in the US government's voluntary pre-release testing process, and starting that week would make Carbon available to a subset of cyber defenders, gradually phasing access to additional trusted partners through Fairwind, before bringing it to developers, businesses and consumers via its product surfaces as soon as possible.

The Fairwind Program page on Google DeepMind's site sets out who that means. The programme gives high-priority defenders early access to advanced models before new threats arrive, and Google states it currently works with over 650 partners globally. Its FAQ prioritises three groups: governments and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and financial networks, and core technology platforms whose software underpins many downstream users. Academic labs focused on defensive benchmarking may apply. Applications go through a Google Cloud account team, and Google says it runs background checks on applicants' security history and ethical record.

Two details on the page matter for anyone considering an application. First, as read on November 5, the programme page still describes its exclusive model as Gemini 4 Argon with cybersecurity defence capabilities, usable standalone or with CodeMender; it has not yet been rewritten around Carbon, so the Carbon announcement is the only primary that ties Carbon to Fairwind. Second, the governance terms are specific: partners may perform only authorised threat simulation, reverse engineering and malware analysis for defensive or academic purposes, must use user-level authentication and phishing-resistant multi-factor authentication, may grant access only to internal security, incident-response or penetration-testing teams, and may not share or resell access. The FAQ says Gemini 4 Argon supports zero data retention when accessed as a managed model on Gemini Enterprise; it says nothing yet about Carbon.

For everyone else, the page is direct: if your organisation is not eligible, you can still protect your code using CodeMender with publicly available models. That is the example of the sibling rule in practice. The gate is on the model, not on the workflow.

OpenAI's ChatGPT Enterprise and Edu release notes for October 30, 2026 are brief. GPT-6 Rosalind Research is rolling out to a limited set of approved Enterprise customers for life sciences research in the Work and Codex surfaces. Access requires Research approval for both the organisation and the user. It is not available in the Chat tab. It starts in a two-week Admin Preview, off by default, and existing Research approval does not bypass that preview. Customers can keep using GPT-5.5 Rosalind Research for existing workflows.

The GPT-Rosalind help article explains the layered structure. GPT-Rosalind is a family of models for life-sciences research with two access tiers. Discovery supports everyday scientific work on the existing Rosalind 5.5 model with stricter monitoring. Research supports what OpenAI calls frontier biological work and includes both GPT-6 Rosalind Research and GPT-5.5 Rosalind Research. Discovery approval does not grant Research access; moving up requires additional review. Eligible organisations with Enterprise or Business agreements request access through OpenAI's trusted-access programme; US academic labs apply through a separate Rosalind Academic Plan that includes no API access.

The article is unusually explicit that none of the ordinary purchase routes open the gate. Buying a subscription or joining a workspace does not grant access. A university email address does not extend an approval across departments. Passing verification or accepting terms does not mean the model is ready to use; a verified owner must authorise activation. API access is approved separately from ChatGPT access, uses the model identifier gpt-6-rosalind, is limited to approved internal research tools rather than customer-facing products, and is not available through Amazon Bedrock.

The example that shows how narrow this is: a pharmaceutical company already approved for Rosalind Discovery, with a ChatGPT Enterprise workspace, cannot select GPT-6 Rosalind Research until it passes a second review for the Research tier, its admin ends a two-week preview, and a custom role grants the model to named users. The failure case is treating "our company has Rosalind" as one fact; the help article describes at least three distinct approvals.

Anthropic's gate is the oldest of the three and the most clearly explained. Its September 1, 2026 launch post states that Claude Fable 5.1 and Claude Mythos 5.1 are the same model with different levels of safeguards. Fable 5.1 is generally available. Mythos 5.1 is available only through trusted-access programmes, with safeguards designed to support work in cybersecurity and the life sciences. We covered the general model in our Fable 5.1 cost and breaking-changes guide; this section is about the door to the other one.

Two programmes are named. The Cyber Verification Program provides access to certain Opus- and Sonnet-class models with reduced cyber safeguards for defensive security work, and Anthropic says it will in the near future include Mythos-class models; applications are taken through a public portal. The Life Sciences Verification Program lets life-sciences professionals use Mythos 5.1 with safeguards designed for professional research and development, while all other safeguards remain in place. Anthropic says it developed the programme in partnership with the US government, has enrolled its first participants, and plans to expand to the broader life-sciences community.

The scope statement is the one to quote. Anthropic writes that Mythos 5.1 is available to vetted cyberdefenders and life scientists, and that it is currently available only to a set of US organisations, with coordination underway with the US government to expand to domestic and international partners. The same post explains what the safeguards on the general model do: Fable 5.1 may be used to discover software vulnerabilities but not to develop exploits, and life-sciences research and development queries are redirected to Anthropic's Opus models. The gate, again, sits exactly on the dual-use edge.

The table states each programme's terms as published. Where a vendor has not stated something, the cell says so.

Each vendor gives a reason, and the reasons are consistent. Google frames Fairwind as giving defenders a head start: the same capabilities that help find and fix vulnerabilities become an equally powerful threat in the wrong hands, so high-priority defenders get early access before new threats arrive. Its Carbon post adds that it is iterating on guardrails with the initial cohort before wider release, and that it is engaged in the US government's voluntary pre-release testing.

Anthropic's explanation is about precision. Its post says the cyber and biology safeguards on the general model have been made less likely to flag benign work, with around 60% fewer cyber interventions per session in Claude Code and biology safeguards firing 85% less often on elementary questions, but that several kinds of dual-use task are still redirected. Mythos 5.1 exists so that vetted professionals whose work is affected by those redirections can proceed. The gate is presented as the complement of a looser default, not a tightening.

OpenAI's pages give the least rationale and the most procedure. The help article describes tiered safeguards, stricter monitoring on the Discovery tier, and reviews that determine which tier an organisation qualifies for. The two-week admin preview that is off by default is itself a governance mechanism: it forces a human administrator to decide who sees a frontier biology model rather than letting it appear in a picker.

An example of how this plays out in regulation rather than marketing: Google and Anthropic both describe engagement with US government processes, and Anthropic's model-level restrictions on cyber tasks mirror the ones its Fable 5.1 documentation already enforces. For the data-handling side of these vendors, our retention and eligibility census tracks which agent features from each vendor fall outside zero data retention.

Most businesses reading this are not national cyber authorities or pharmaceutical research groups. For them the gates change three things. First, model comparisons need a column for availability. A benchmark table that lists Carbon beside Argon, or Mythos 5.1 beside Fable 5.1, is comparing a model you can buy with one you cannot, and the vendors' own pages say which is which. Our Gemini 4 Argon migration guide covers the model Google is actually selling today.

Second, the gated model usually tells you what the general model will not do. Anthropic's post is explicit that Fable 5.1 redirects exploit development and life-sciences R&D to Opus-class models; a security team that hits those redirections has its answer about whether to apply to the Cyber Verification Program. Google's Fairwind page likewise tells non-members to use CodeMender with public models. The gate documents the boundary of the product you have.

Third, pricing signals are weaker than they look. Carbon's stated price is identical to Argon's introductory price, which suggests Google intends the two to sit in one tier, and a footnote says that once the introductory period expires the price becomes $4 per million input tokens and $20 per million output tokens, without giving a date. A budget built on Carbon should use the $4 and $20 rates, since the switch date is unknown. The failure case is a vendor-selection memo that recommends a gated model on benchmark strength; the memo should recommend the sibling and note the gate.

Four situations cover most of the organisations our AI transformation practice works with. The routes follow the vendors' stated eligibility, not our reading of it.