Who Gets the Cyber AI Models: Every Vetting Programme Listed

On September 2, 2026 Google launched the Fairwind Program, “a limited access program for governments and trusted partners to use our most advanced cyber defense capabilities,” with Gemini 3.8 Flash Cyber as its first model. It joins Anthropic’s Project Glasswing and Cyber Verification Program, through which Claude Mythos 5.1 is reaching “a set of US organizations” since September 1, and OpenAI’s Daybreak Access for “verified defenders.” Microsoft sells its cyber model inside a product, and Z.ai gates its open-weight model with a two-week delay rather than a form.

We have written about the trend twice, when government-gated releases became the pattern in June and when Google shipped its first gated Flash in July. What neither post has, and what a security lead or a policy reader needs on the day a new programme opens, is the table: every programme, in the vendor’s own words, side by side. That is this page, and it will be refreshed rather than re-written as programmes change.

Google’s programme is the most explicit about who it wants. The launch post, by Google’s Vice President for Security and Privacy, names three groups in priority order: governments and national cyber authorities, critical infrastructure operators across “healthcare, telecommunications, energy, and financial networks,” and core technology platforms whose software reaches “millions of downstream users at once.” The programme page adds that Google conducts background checks on applying organisations “to verify security history and analyze their record of ethical operations,” and that participants agree to limit access to internal cybersecurity, incident-response or penetration-testing staff and to deploy multi-factor authentication.

What members get is Gemini 3.8 Flash Cyber paired with CodeMender, Google’s find-verify-fix harness, inside the member’s own cloud environment. Google’s claims for the model, from the same day’s 3.8 Flash launch, are vendor-run: a success rate above 70% on an internal vulnerability-discovery benchmark across 20 languages, CWE-Bench pass@1 of 47.2% against 47.8% for “a leading frontier model,” 2.6 times more correct Chrome patches than “the best commercial models,” and Wiz’s report of 7.5 to 9.7 points more recall at 2.3 to 5.2 times lower cost. Non-members are pointed at CodeMender with public models. The claim of “more than 650 participating partners globally” on launch day is Google’s and is not itemised.

Read down the “route in” column and the eight rows sort into three designs. The first is the vetted application: Google, Anthropic and OpenAI all take a form, check the organisation, and decide. They differ in who they say yes to. Google leads with governments and infrastructure. Anthropic’s CVP is for “vetted individuals and organizations whose work is affected by the cybersecurity restrictions,” and for Mythos 5.1 specifically that currently means US organisations, while Glasswing was built around named partners and open-source maintainers with $100M in credits. OpenAI’s Daybreak Access is for “verified defenders” and pushes most organisations toward a partner rather than direct access, with Patch the Planet as the open-source route.

The second design is the product. Microsoft’s MAI-Cyber-1-Flash is delivered inside MDASH, and the post describes tenant isolation, role-based access and sandboxes with no internet rather than an application; the gate is a contract. The third is the delay. Z.ai’s GLM-5.3 post said the weights would follow “two weeks after launch, once safety evaluation and hardening are complete,” because cyber capability “developed faster than we expected,” and they did. The open-weight answer to a dangerous capability is a fortnight, after which everyone is eligible. One row belongs to none of the three: OpenAI’s Astra is gated from everyone, including much of OpenAI, until its controls catch up.

Most organisations reading this will not qualify for the vetted rows and should not assume they need to. The day these programmes opened, the generally available models moved too: Anthropic now permits vulnerability discovery on Fable 5.1 for any customer, and the curl result we covered the same day shows a specialised system on ordinary models out-finding a gated frontier scan on production code. The router below is how we would place an organisation against the table.

For the last group, which is most of our clients, the practical change this week is not a gate but a permission: the general Fable 5.1 will now look for vulnerabilities in your code. That is work our web development practice already runs with a human acceptance step, and the table above is what we check before telling a client that a gated model is, or is not, something they can get.