What is trusted access in AI? Why Google, OpenAI and Anthropic give their best hacking-capable models to vetted defenders first
Trusted access is a way of releasing AI models with strong hacking ability: instead of opening them to everyone, a developer gives them first, or only, to defenders whose identity and purpose it has checked, such as governments, infrastructure operators and security teams. OpenAI piloted it on February 5, 2026 and grew it into Daybreak; Anthropic moved from Project Glasswing in April to a three-tier Cyber Verification Program on October 6; Google used its Fairwind Program, with more than 650 partners, to give Gemini 4 Carbon to defenders first on October 28. Government pre-release testing asks whether a model is dangerous; trusted access decides who uses it
The three lines
- Definition — finding bugs and exploiting them are the same skill, so vetted defenders get the model first or exclusively
- Three labs — Google Fairwind; OpenAI Daybreak (Blue, Red); Anthropic Cyber Verification Program (Defense, Red Team, Specialized)
- Limits — opaque vetting, a few firms as gatekeepers, a high-value target for attackers, and no independent measure of impact yet
Key questions
- what is trusted access ai
- **A release model that opens dangerous AI capabilities in stages, only to people whose identity and purpose are verified.** | Item | Detail | |---|---| | Capabilities covered | Mostly cyber (finding bugs, writing exploits); some life sciences | | Recipients | Governments, infrastructure operators, security teams, open-source maintainers | | Core controls | Identity checks, use limits, usage logs, tiered unlocking | | Main examples | Google Fairwind, OpenAI Daybreak, Anthropic Cyber Verification Program |
- why are ai cybersecurity models not publicly released
- **Because the skill that finds and fixes a bug is the same skill that exploits it.** | Capability | In defender hands | In attacker hands | |---|---|---| | Finding vulnerabilities | Fixed before disclosure | Zero-days to use | | Writing exploits | Risk validated | Live attacks | | Malware analysis | Detection rules | Evasive variants | | Long autonomous work | Overnight code audits | Unattended campaigns |
- trusted access vs ai safety institute testing
- **Pre-release testing asks whether a model is dangerous; trusted access decides who gets to use it.** | | Government pre-release testing | Trusted access | |---|---|---| | Run by | US CAISI, UK AISI and peers | The model developer | | Who gets the model | Government evaluators | Vetted defenders | | Goal | Risk assessment | Defensive head start | | Timing | Before launch | Ongoing after launch | | Legal basis | Voluntary agreements | Company terms of use |
An AI that finds and fixes bugs is also an AI that finds and exploits them. Through 2026, Google, OpenAI and Anthropic have stopped releasing their strongest security-capable models to everyone at once. Instead they hand them first to defenders whose identity and purpose they have checked — governments, operators of power grids, hospitals, telecom networks and banks, and security teams. The industry calls this trusted access.
The latest example is Gemini 4 Carbon, which Google announced on October 28. Google calls it its strongest model, yet its first users were not developers but a subset of cyber defenders. This explainer covers why the practice emerged, how the three big programs differ, how it differs from government pre-release testing, and where it is weak.
1. Why trusted access exists — same skill, different hands
Security has always run on a simple rule: you cannot defend against what you do not understand. That makes most security tools dual-use; penetration-testing kits are used by criminals too. AI sharpens the problem through speed and scale. Vulnerability hunting that would take dozens of human experts months can now run for days across thousands of projects at once.
| Capability | In defender hands | In attacker hands |
|---|---|---|
| Finding vulnerabilities | Fixed before anyone exploits them | Unpatched zero-days |
| Writing exploits | Real-world risk validation | Immediate attacks |
| Malware reverse engineering | New detection rules | Variants that evade detection |
| Long autonomous work | Overnight audits of huge codebases | Unattended attack campaigns |
Once a model is public, those two columns cannot be separated. So developers began deciding, before release, whose hands get it first.
The policy group IAPS framed the idea in 2025 as "differential access": the more dangerous a capability, the narrower the access — but defenders are never cut out at any level.
| IAPS approach | Capability risk | How access works |
|---|---|---|
| Promote Access | Lower | Open widely and actively push to defenders |
| Manage Access | Medium | Controlled distribution, priority for some defenders |
| Deny by Default | Higher | Select defenders only; benefits spread indirectly |
Timeline
| Date | Event |
|---|---|
| May 2025 | IAPS publishes its differential access report |
| Feb 5, 2026 | OpenAI pilots Trusted Access for Cyber, with $10M in API credits |
| Apr 7 | Anthropic launches Project Glasswing, limiting Claude Mythos Preview to 12 launch partners and others, with up to $100M in usage credits |
| Apr 15 | OpenAI expands the program to thousands alongside the security-tuned GPT-5.4-Cyber |
| May 5 | US CAISI signs pre-release testing agreements with Google DeepMind, Microsoft and xAI |
| Sep 2 | Google, Anthropic and OpenAI announce security models and access limits on the same day |
| Sep 3 | OpenAI commits $1B in subsidized access for under-resourced defenders (Daybreak for Frontline Defenders) |
| Oct 6 | Anthropic merges Glasswing into a three-tier Cyber Verification Program |
| Oct 28 | Google gives Gemini 4 Carbon to select defenders first |
2. The three programs compared — Fairwind, Daybreak, CVP
| Item | Google Fairwind | OpenAI Daybreak | Anthropic Cyber Verification Program (CVP) |
|---|---|---|---|
| Origin | Reported with Gemini 3.8 Flash Cyber in September | Feb Trusted Access for Cyber pilot → Daybreak in May | Earlier CVP + April Project Glasswing |
| Latest models | Gemini 4 Argon, Gemini 4 Carbon | GPT Cyber models such as GPT-5.6-Cyber | Mythos 5.1, Opus 5.5, Sonnet 5.5 |
| Tiers | Single (priority vetting) | Blue / Red / Red plus model approval | Defense / Red Team / Specialized |
| Priority users | Governments and national cyber authorities; healthcare, telecom, energy, finance; core tech platforms | Organizations and qualified individuals | Security teams, security firms, open-source maintainers; Specialized for infrastructure testers |
| Individuals | Effectively no (students pointed to other tools) | Blue tier | Defense tier (with a disclosure track record) |
| Government role | None disclosed | None disclosed | Specialized applicants reviewed with the US government |
| Scale | 650+ partners | About 2,000 approved organizations (reported) | Glasswing partners found 129,000+ verified vulnerabilities, Apr–Jul |
What each tier unlocks
| Lab and tier | Allowed | Still blocked |
|---|---|---|
| OpenAI Blue | Secure code review, vulnerability triage, malware analysis, detection engineering, incident response, patch validation | Red-tier work such as exploit development |
| OpenAI Red | Blue plus penetration testing, red teaming, exploit validation and development | Anything on systems not owned or authorized |
| Anthropic Defense | Security operations, incident response, malware reverse engineering, vulnerability analysis | Penetration testing |
| Anthropic Red Team | Defense plus authorized penetration testing | Actions that could cause physical harm or mass outages, such as deploying ransomware |
| Anthropic Specialized | Fewest cyber limits (testing aviation, grids, telecom, interbank transfers) | No public list |
| Google Fairwind | Authorized threat simulation, reverse engineering, malware analysis | Creating malware; sharing or reselling access |
The programs look alike but rest on different philosophies. Google is institution-first, naming governments and infrastructure as priorities. OpenAI is identity-first: individuals can join after proving who they are with hardware security keys and a paid account, and the company has argued it should not centrally decide who gets to defend themselves. Anthropic is task-first: every tier gets the same models, but each tier is bound to a different set of permitted tasks.
Common conditions
| Condition | OpenAI | Anthropic | |
|---|---|---|---|
| Strong identity | User-level authentication, phishing-resistant MFA | Advanced Account Security, FIDO2 keys (individuals) | Identity and affiliation checks |
| Scope limit | Internal security, incident response, pen-test teams | Systems owned or authorized | Systems the user may test |
| Usage records | Must track employee access and use | Admins enable per user or project | Consent to data retention for misuse monitoring |
| Resale | Banned | — | — |
3. How it differs from government pre-release testing
Trusted access is often confused with pre-release testing by government AI safety institutes. Both hand a model to someone before the public, but their aims are opposite.
| Government pre-release testing | Trusted access | |
|---|---|---|
| Run by | US CAISI, UK AI Security Institute and peers | The model developer |
| Who gets the model | Government evaluators | Vetted defenders |
| Goal | Assess risk | Give defense a head start |
| Duration | A window before launch | Ongoing after launch |
| Output | Evaluation findings (no duty to publish) | Real patches and detections |
| Legal basis | Voluntary agreements | Company terms of use |
| Example | US CAISI, agreements with five labs | Fairwind, Daybreak, CVP |
On May 5, 2026, CAISI, part of the US Commerce Department, signed pre-release testing agreements with Google DeepMind, Microsoft and xAI, bringing the number of participating labs to five with OpenAI and Anthropic. Developers can hand over versions with reduced safeguards so cyber, biological and chemical risks can be probed. Google said in the Carbon announcement that it is taking part in the US government voluntary pre-release process. South Korea has its own AI Safety Institute, set up in November 2024, but no comparable pre-release arrangement with these labs has been disclosed.
The two mechanisms do overlap. Anthropic reviews Specialized applicants together with the US government, moving government from tester toward gatekeeper. In September, the White House also asked the UK institute to pause access to new models for 17 days — another case of governments shaping the order of access.
4. Strengths and weaknesses
| Strength | Evidence or example |
|---|---|
| Defense gets a head start | Glasswing partners found 129,000+ verified vulnerabilities, Apr–Jul (Anthropic figure) |
| Tools reach the people who fix things | Open-source maintainers, local governments and community banks now targeted (Anthropic Defense tier; OpenAI $1B program) |
| Tier controls actually bite | Anthropic test: all 50 attempts blocked at first prompt without CVP; 46 blocked at Defense tier; 34 completed at Red Team tier |
| Accountability | Identity and usage logs make misuse traceable |
| Weakness | Detail |
|---|---|
| Opaque vetting | Rejection reasons are not published; the company has the final word |
| A few firms become gatekeepers | Private companies decide which countries and institutions defend first |
| A high-value target | IAPS warns that a model reserved for select defenders becomes a prize for attackers |
| Finding outpaces fixing | Reports keep showing far fewer completed patches than discoveries |
| No measure of impact | No independent data yet shows gated access kept defense ahead |
| Self-run tests | An IDC analyst called Anthropic tier test vendor-run, not independent |
The deepest question is time. Trusted access buys defenders a window before attackers reach similar capability. Once a rival lab or an open-weight model gets there, the window closes. No company has said whether it expects that window to last weeks or months.
5. How organizations and individuals get in
| Program | Organizations | Individuals | Where to apply |
|---|---|---|---|
| Google Fairwind | Governments, infrastructure, core platforms first; academic labs may apply | Effectively not; others are pointed to the CodeMender security agent on public models | Google Cloud account team |
| OpenAI Daybreak | Blue and Red; Red needs separate review | Blue only; paid plan, Advanced Account Security, FIDO2 keys | Trusted Access for Cyber application, then admins enable per user |
| Anthropic CVP | Defense, Red Team, Specialized | Defense only, with a vulnerability disclosure record | Defense review in days, Red Team in weeks |
None of the three companies publishes guidance for applicants in South Korea, where this site is based.
6. What remains and what is unconfirmed
- Impact: No independent measurement shows narrower access left defense ahead of offense. Most published numbers are discovery counts from the companies.
- Vetting criteria: None of the three publishes detailed criteria or rejection reasons.
- General release: No company has said when defender-only models such as Carbon or Mythos will reach the public, or what would trigger it.
- Korean participation: Whether any South Korean institutions take part is unconfirmed.
- OpenAI details: Daybreak tier structure and individual requirements were confirmed through a security vendor summary rather than OpenAI pages.
Sources
- IAPS — Asymmetry by Design: Boosting Cyber Defenders with Differential Access to AI
- CyberScoop — OpenAI expands Trusted Access for Cyber to thousands (2026-04-15)
- Checkmarx — OpenAI Daybreak: how it works, getting access, limitations and risks
- Let's Data Science — OpenAI Launches Daybreak for Cyber Defenders (2026-09-04)
- Constellation Research — Anthropic launches Project Glasswing, Claude Mythos Preview (2026-04-07)
- CSO Online — Anthropic widens access to AI cyber capabilities for vetted security teams (2026-10)
- Google DeepMind — Fairwind Program
- Google blog — Gemini 4 Carbon: our next frontier model (2026-10-28)
- Cloud Security Alliance — CAISI Frontier Testing Agreements Reach Five Labs (2026-05)
- MLex — US CAISI enters pre-deployment agreements with Google DeepMind, Microsoft, xAI (2026-05-05)