Cyber AI Models
A dive into major cyber models being released
Image: Source
Major players like Google, Anthropic, and OpenAI are incorporating cybersecurity related features into LLMs, with Google announcing its latest Gemini 3.8 Flash Cyber, which has supposedly surpassed Anthropic's Mythos 5 and OpenAI's GPT-5.6 Sol and Gpt-5.5 Cyber. In this article, I wanted to explore a few key topics related to these cyber models: Capabilities, Safeguards, Access, Future
Capabilities
A key capability is autonomous vulnerability discovery, where these models are able to discover zero-day vulnerabilities, or chain exploits to carry out more sophisticated attacks. During testing, OpenAI reported that its latest model Astra achieved a perfect score on an external exploit benchmark called ExploitBench, meaning it could perfectly develop exploits from known vulnerabilities. This newer model could also achieve significantly higher arbitrary code execution rates with fewer output tokens compared to its predecessor GPT-5.6 Sol. The same model was also able to achieve privilege escalation by chaining multiple vulnerabilities on a hardened Operating System. On Anthropic's side, Fable 5.1 can be used to identify software vulnerabilities, but other tasks like penetration testing may be redirected to the Opus line. Another notable point is that the models are actually "willing to take (any) harmful actions in single-minded pursuit of their goals", which is related to the recent unauthorised access incidents.
These capabilities are astounding and really do put into perspective how powerful these models have become. Being able to not just find zero-days, but also use them as part of a more sophisticated exploit chain is amazing, and seems to mimic the capability of a superior security researcher. But they also highlight the importance of safety measures needed for these models, because these capabilities shouldn't fall into the wrong hands. The last line also stresses the one-dimensional nature of AI models which we may forget. They are given a single goal, and are highly optimised to achieve that goal to their highest ability. So these goals must be defined rightfully, without harm to others.
Safeguards
Claude Mythos 5.1 is able to refuse malicious agentic coding and computer use requests to a greater extent than previous models, and Anthropic also came up with Enterprise Frontier Safeguards (EFS), which combines zero data retention with misuse detection safeguards. Anthropic has also added hardening, containment and monitoring measures to ensure models stay aligned with their intention and boundaries. An example is the implementation of a classifier that detects and blocks sandbox escape attempts, which is part of their response to the recent unauthorised access incidents. OpenAI also strengthened its latest model Astra's protections against misuse and unauthorised actions, as well as improving the rate of declined jailbreaking requests from 59% in GPT-5.6 Sol to 91.5% now. Like Anthropic, OpenAI also has added classifiers and layered protections.
OpenAI itself warned that the "safeguards may erroneously flag legitimate activity as cyber misuse or unauthorised behaviour", and this implies a difficulty in achieving a balance between security and performance in AI systems, perhaps LLMs particularly. Being too restrictive means the False Positive rate might be high, but being too permissive means False Negatives will be high instead. This stresses the importance of balance, as well as perhaps raising the question of whether one should be prioritised over the other. But digging deeper, a better solution may actually be to adopt a hybrid approach. For more severe consequences, such as the model enumerating or exploiting weaknesses in external systems, a more restrictive approach seems like the right one, since there is no room to provide such capabilities to malicious actors. However, for less sensitive areas, such as users going slightly off topic, being slightly more permissive would retain a smooth user experience without overdoing censorship.
Access
Firstly, the Gemini model has been developed with a priority of vulnerability fixing rather than offensive capabilities so as to provide defenders with an edge. And that leads into why the access to the Gemini 3.8 Flash Cyber model is only being given to trusted entities under the Fairwind Program. High-priority defenders like governments and healthcare providers are being given early access so that they can defend before new threats arrive. Anthropic is following a similar approach, with its latest Claude Mythos 5.1 model only being available through its trusted access programs, while OpenAI also aims to only release the most advanced cybersecurity features of the latest Astra model to a group of testers as part of their Daybreak Blue program.
Limiting access to trusted parties is definitely the right play here. In these early stages, it is likely that the safeguards are not concrete and still need to be tuned. The full capability of the models may also be insufficiently tested or determined, and allowing trusted testers as well as users to utilise them first provided necessary and safe feedback for these companies to really ensure security. Especially in the light of recent events, these companies have been under "intense scrutiny" as TheHackerNews stated, so they cannot afford any mistakes.
Future
The article ends by mentioning how "over 100 companies are now calling for improved defenses to defend against (AI) threats". This demonstrates the need for more focus on AI security and for experts to expend efforts in this domain as well. It's a bit ironic that we need experts to build defenses for these AI models that are going to defend others, but that also seems to be the state of affairs in today's AI landscape. More than anything, I believe it demonstrates the need for professionals to always understand fundamentals. Yes, AI can be built on our knowledge and streamline many processes, but the underlying understanding has to be sound, and that has to come from us first before these AI models can be built on top of that.