Hot take: gating a cyber model behind vetted customers is a patch, not a safety strategy

OpenAI just shipped GPT-6 Cyber, and the access model is the real story. It is limited to vetted customers, and OpenAI rates it "Critical" for cybersecurity under its own Preparedness Framework. Days earlier, Tencent released a model trained with deliberately limited cybersecurity data. Two labs, two opposite answers to the same problem.

Here is what I verified. CyberScoop and The Hacker News both report that GPT-6 Cyber is restricted to approved Daybreak Red organisations through the API and Codex, with broader availability promised later. Reuters reported on 4 November that Tencent's new model was trained with cyber material restricted to defensive content, with exploit development, reverse engineering and penetration testing filtered out. Tencent says its internal testing found no sign the model raised the risk of break-ins. Those are the companies' own claims, and nobody outside has tested them yet.

So one lab controls who can call the model. The other controls what the model ever learned. I think both approaches have a ceiling.

Access gating depends on identity checks, allowlists and monitoring, and every one of those is a human process that can fail. I have worked on a defence deployment where the question was never "is the model good?" It was "who can touch it, and where does it run?" Once a capable system sits behind someone else's API, you are trusting their vetting forever.

Data filtering has a different problem. Security knowledge is not a clean folder you can leave out. Defensive and offensive skills overlap heavily. A model that understands how to patch a flaw has to understand the flaw. You can reduce capability, but you cannot cleanly separate it, and the only way to know is to test, repeatedly, by people who are not selling the model.

That is why I keep coming back to evaluation. In my own research and in the open-source tooling I publish, the lesson is the same: a safety claim without an independent measurement is a marketing line. Hallucination detection, drift monitoring and bias auditing all exist because vendors' self-reports were not enough. Cyber capability needs the same treatment.

There is also a structural point that gets missed. A frontier cyber model behind a hosted endpoint means defenders must send sensitive code and infrastructure details to a third party to use it. For a lot of the teams I have built systems for, in defence and in regulated industries, that is a non-starter. My bias has always been that models should run where the data is: on-device, offline, under your control. Security work is the sharpest example of why.

Smaller, narrower models running inside your own perimeter can do a lot of defensive work: triaging alerts, reviewing diffs, flagging risky dependencies. They do not need to be the model that writes working exploits. Matching the capability to the job is cheaper and safer than renting the most dangerous tool available and hoping the gate holds.

I am not saying restricted release is wrong. For a model that OpenAI itself rates Critical, it is the responsible minimum. But a minimum is not a strategy. A strategy has independent testing, clear reporting when something goes wrong, and defenders who can run useful tools without shipping their crown jewels to someone else's servers.

There is one more thing I would watch. Tencent says it will publish its weights and a safety report later. If it does, outsiders can test the claim directly. If a gated model and an open one are measured on the same defensive and offensive tasks, we will finally learn which control actually works. Until then, both are promises.

My takeaway: do not judge a cyber model by who is allowed to use it. Judge it by what independent testers can prove it can do, and by whether you can run it without handing over your data.