AI Crosses the Critical Cyber Line and Picks Who Gets the Shield

AI crossed a red line this month: Critical is the top cybersecurity tier in OpenAI's Preparedness Framework, and Astra is the first model to reach it.

Three labs drew the same line in one week

Within roughly 48 hours over 1–2 September 2026, OpenAI, Google and Anthropic each shipped offence-grade cyber AI and locked most of the world out of the strongest version. OpenAI moved first. According to SecurityWeek, OpenAI classified Astra at the Critical cybersecurity level of the Preparedness Framework — the first OpenAI model to reach the tier, confirmed the same day by CNBC.

The benchmarks are not subtle. Astra scored 100% on ExploitBench, the test of building working exploits from known vulnerabilities, and declined 91.5% of cyber jailbreak attempts against 59% for the previous GPT-5.6 Sol model. During testing, Astra found two previously-unknown zero-days in Google's V8 JavaScript engine, chained the two flaws into a working exploit, then broke out of a browser sandbox to run commands on the host — an unprivileged-user-to-root escalation OpenAI is now disclosing to maintainers.

Critical, in OpenAI's own framework, describes a model that can independently find and exploit zero-days across many well-defended systems, or run a complete cyberattack on a hardened target from a single high-level instruction. When a model crosses the Critical mark, the danger stops being theoretical — which is why OpenAI kept the full capability inside the Daybreak Blue program and shipped a weaker public build.

We are entering a stage of AI development in which models can take on more consequential work, and failures of alignment and control can have more serious effects.

— — OpenAI, "Responding to the next frontier of critical cyber capabilities"

The shield now comes with a guest list

Google made the pattern explicit. On 2 September 2026 Google announced Gemini 3.8 Flash and 3.8 Flash Cyber, a model the Google Chrome Security team says produced 2.6 times more correct patches to Chrome vulnerabilities than the best commercial models, with autonomous vulnerability discovery above 70% across 20 programming languages. Alongside the model came the Fairwind Program.

Fairwind is an allow-list. Google describes more than 650 partners globally, with early access prioritised for governments and national cyber authorities, critical-infrastructure operators in healthcare, telecom, energy and financial networks, and approved cyber teams — CrowdStrike, Datadog, Palo Alto Networks and Snowflake among the named partners. Access requires membership of an internal security team and multi-factor authentication. Google.org adds more than $100M in cyber funding, including $36M to 35 clinics serving 1,250+ US hospitals, school districts and municipal utilities.

Anthropic drew the line down the middle of a single model. On 1 September 2026 Anthropic released Claude Fable 5.1 for general use and Mythos 5.1 behind restricted access — the same underlying model in two safety configurations, as VentureBeat reported alongside a 75% cost cut for Fable cache reads. Fable 5.1 may now identify software vulnerabilities defensively, while penetration testing and exploit generation route to the gated Mythos-class Opus models. Anthropic also paused external cyber evaluations of pre-release models and shipped a new sandbox-escape classifier.

The privacy architecture points the same way. Anthropic's Enterprise Frontier Safeguards pair automated misuse detection with zero data retention, storing activity data in customer-controlled cloud infrastructure and rolling out in phases from autumn 2026. As The Hacker News documented, the three labs converged on one architecture: strong cyber capability, released only to a vetted club.

The frontier just armed the defenders — and then wrote the list of who counts as one.

— — Humphrey Theodore K. Ng'ambi

Where is Lusaka on the list?

Read the guest list closely and a geography appears. The trusted defenders are incumbents and rich-country institutions: American hospitals reached through Google.org clinics, the large security vendors, the national cyber authorities of states that already fund national cyber authorities. A hospital in Lusaka, a bank in Lagos, a municipality in Solwezi holds no Google Cloud enterprise contract and answers to no national cyber body that Fairwind recognises. None of these institutions picks up the shield, and none gets early access.

The gating is not wrong. Keeping a model that finds zero-days unaided away from ransomware crews and hostile states is a legitimate safety response, and the labs deserve credit for choosing restraint over reach. The problem is the second-order effect. Attackers do not need Fairwind. Offensive capability leaks, gets reverse-engineered, or arrives through open-weight tooling, as earlier breaches already showed. The shield is gated; the sword is not.

So access asymmetry becomes defence asymmetry. Here I reach for Emergent Intelligence (EI) — the dignity-first frame I use for what the world calls AI. Under an EI lens, safety is not a club you are admitted to; safety is a form of stewardship owed to everyone a system can harm. Ubuntu names the same idea in four words: I am because we are. A cyber-defence order that protects Palo Alto's customers and leaves a Solwezi clinic exposed has not solved the safety problem — the order has relocated the risk onto the people with the least standing to object.

Data supports the worry. Google's own numbers show where the money lands: $36M to US clinics, 1,250+ US institutions, and no rand named for the Global South. Analysis of the three announcements reveals no African, South Asian or Latin American national cyber authority on the priority tier. The evidence is not of malice. The evidence is of a default — a security model built by and for the places where the model-builders already sit.

What equitable stewardship would ask

A dignity-first answer does not tear down the gate. Equitable stewardship would widen the gate: pooled defensive access for public-interest institutions regardless of contract size, regional cyber authorities treated as first-class partners, and defensive patching tools offered to hospitals and municipalities in Lusaka and Lagos on the same day as Boston and Berlin. The frontier decided defenders deserve a shield. The open question is whether a defender in Solwezi counts as one.

Frequently Asked Questions

These are the questions people are asking about the Critical cyber threshold and defender-only AI. Short answers follow, drawn from OpenAI, Google and Anthropic's own September 2026 announcements and the reporting around them.

What is the Critical cyber tier in AI?

In short, Critical is the top cybersecurity level in OpenAI's Preparedness Framework. According to SecurityWeek, the tier describes a model that can independently find and exploit zero-days across well-defended systems, and Astra is the first model OpenAI has placed there, on 1 September 2026.

How does Astra find zero-days on its own?

Simply put, Astra automates the hunt. Research and OpenAI's own testing show Astra scored 100% on ExploitBench and, unprompted, discovered two zero-days in Google's V8 engine and chained the flaws into a working exploit during a benchmark run.

Why is defender-only gating significant?

The key is who ends up protected. Analysis of the Fairwind, Daybreak Blue and Mythos 5.1 programs shows offensive cyber AI released only to vetted partners, which data suggests concentrates the strongest defences among incumbents and rich-country institutions.

Who is the Fairwind Program for?

In other words, Fairwind is for approved defenders, not the public. Google's evidence lists more than 650 partners — governments, national cyber authorities, critical-infrastructure operators and named vendors such as CrowdStrike and Palo Alto Networks — each gated behind internal-team membership and multi-factor authentication.

What are the risks of gated cyber AI?

The answer is a two-tier cyber world. Data reveals the shield gated to allow-list members while offensive tooling leaks or arrives open-weight, leaving hospitals, banks and municipalities across the Global South exposed to the same attacks the vetted club is equipped to survive.

Sources:

SecurityWeek: Astra crosses Critical · CNBC: OpenAI Astra · OpenAI: Responding to the next frontier · TechTimes: Daybreak Blue access caps · Google: Gemini 3.8 Flash Cyber · Google: Fairwind Program · TechCrunch: Claude Fable 5.1 · VentureBeat: Fable 5.1 and Mythos 5.1 · Unite.AI: Enterprise Frontier Safeguards · The Hacker News: cross-lab cyber wave · Related on this site: GPT-5.6 Sol, Daybreak and AI vulnerability hunting · Claude Mythos and the gated frontier · The other side of the gate: open-weights and guardrails