Claude Mythos 5.1 and Gemini 3.8 Flash Cyber: the safeguard became an access tier

On 1 September 2026 Anthropic released Claude Fable 5.1 and Claude Mythos 5.1, and described the pair in one sentence: "Claude Fable 5.1 and Claude Mythos 5.1 are the same model, but with different levels of safeguards." A day later, on 2 September, Google released Gemini 3.8 Flash alongside Gemini 3.8 Flash Cyber, a variant that "ships with a more permissive set of mitigations for cybersecurity" and is "only available to trusted defenders".

Two labs, two days, the same shape. In each case the capability is not what is being sold differently. The safeguard is. And the thing that decides which safeguard you get is no longer your prompt. It is an assessment of who you are.

That is a quiet change in how frontier models are distributed, and it matters most to the people it was designed for: security teams, and the organisations that employ them.

Two releases with the same structure#

Anthropic's version is the more explicit of the two. Mythos 5.1, in its words, "is identical to Fable 5.1, but it offers more permissive safeguards for vetted individuals and organizations". It is offered through two trusted access programmes: the Cyber Verification Program for defensive security work, and a Life Sciences Verification Program for professional research and development. The Cyber Verification Program is not new. Anthropic notes that it "currently provides access to certain Opus- and Sonnet-class models with reduced cyber safeguards for defensive security work". Mythos 5.1 extends that arrangement to its newest model.

Then comes the sentence that matters most outside the United States: "Currently, it is only available to a set of US organizations, though we're coordinating with the US government to expand access to a broader set of domestic and international partners as quickly as possible."

Google's wording is looser. The announcement describes the two models as powered by "the same foundational intelligence", not as identical, so I would not assume the weights match exactly. The commercial structure is the same either way. Gemini 3.8 Flash is generally available through Google AI Studio, the Gemini API and Gemini Enterprise. Gemini 3.8 Flash Cyber is available through a new programme called Fairwind, which provides "trusted government authorities, as well as critical infrastructure operators and software maintainers with prioritized access".

The general tier moved too#

It would be easy to read this as the labs locking capability away. The more interesting detail is what happened to the model everyone can use.

Anthropic says Fable 5.1 can now be used to discover software vulnerabilities, though not to develop exploits for them. It says Claude Code users "can expect an average of around 60% fewer interventions per session from our cyber safeguards, relative to the previous safeguards on Fable 5." Some dual-use security tasks are still redirected to its Opus models, and life sciences research queries "will still be directed to our Opus models".

On the Google side, the general model ships with safeguards against misuse in chemical, biological, radiological and nuclear domains and in cyber offence, under Google's Frontier Safety Framework.

My read, and it is an inference rather than anything either lab has said: once a permissive tier exists behind a vetting gate, the public tier can afford to be less jumpy. The hard cases have somewhere else to go. A safeguard that has to serve every possible user at once has to be tuned for the worst one. A safeguard that knows the worst cases can be routed elsewhere can be tuned for the typical one. If that is right, splitting the model in two is what allowed the default to loosen.

The control moved from the prompt to the customer#

A safeguard that reads the prompt makes its decision per request, with only the text in front of it. It cannot know whether the person asking about a heap overflow is a maintainer patching their own library or someone shopping for an exploit. So it guesses, and every guess is either a false positive that annoys a defender or a false negative that helps an attacker.

A vetting programme makes its decision once, per organisation, before any request is sent. Look at what Google's Fairwind page actually asks about. Participating organisations "agree to specific terms, including user-level authentication, phishing-resistant MFA" and access controls. "Access to the Fairwind Program is strictly controlled", with no redistribution of access. Google says it conducts background checks on organisations and looks for "a proven track record of ethical operations and research".

None of that is about the prompt. It is know-your-customer, applied to model access. Who are you, what have you done, and how do you protect the keys once you have them.

That trade has real advantages. The vendor gets context that no classifier could ever read out of a single request, and the defender stops fighting the model over every legitimate question. It also has costs that are worth naming plainly. The decision is made by the vendor, on criteria the applicant sees only in outline. There is no published timeline: the Fairwind page says Google "will review and respond to eligible partners who meet our criteria as soon as we can". And in Anthropic's case, any expansion of access is being coordinated with the US government.

What this looks like from outside the US#

For a security team in Saudi Arabia, the two programmes read very differently today.

Mythos 5.1 is closed to you for now, whatever your merits, because it is currently limited to a set of US organisations. Anthropic says it is working to expand to international partners. Until that happens, the model a Saudi security team can use is Fable 5.1, with its new allowance for vulnerability discovery and its redirection of some dual-use tasks.

Fairwind's eligibility is written in categories of organisation rather than countries. It prioritises governments and national cyber authorities, critical infrastructure operators in healthcare, telecommunications, energy and financial networks, and core technology platforms that "secure widespread software foundations". Those categories map closely onto the sectors that carry most of the weight in the Gulf economy. Fitting a category is not the same as being admitted, though, and the admission decision sits with Google.

Neither programme is written for regional service providers, mid-sized companies, or the security function inside a business that is neither critical infrastructure nor a platform. For those teams, the general tier is the product, and it is worth planning around that rather than around access they do not have. I made a related argument about why Saudi Arabia is an interesting place to build enterprise AI: the constraints here are specific, and they reward building for what is actually available.

What I would prepare now#

If you run a security function and either of these programmes is in your future, most of the preparation is useful whether or not you are admitted.

1. Build on the general tier first. Vulnerability discovery is now permitted on Fable 5.1. Design your workflows around discovery, triage and patching, which do not depend on exploit development, and you have something that runs today.
2. Put the identity controls in place before you apply. User-level authentication, phishing-resistant MFA and real access controls are what Fairwind's terms name. They are also what you should have anyway on any key that can reach a capable model. No shared API keys, no service account that five people log into.
3. Keep an honest evidence file. A track record of ethical research and responsible disclosure is what the vetting looks for. Write down what you have actually done. Do not pad it.
4. Plan for two model identifiers, not one. If you are admitted, you will be running a permissive tier alongside a general one. Route by task, log which tier handled what, and make sure your agents cannot quietly escalate themselves from one to the other. This is the same point I made about production agents inheriting your permissions model: the boundary has to live in your system, not in the model's judgement.
5. Read the data terms of the permissive tier as carefully as the capability. Google notes zero data retention is supported when Flash Cyber is accessed through Gemini Enterprise Agent Platform. Security work touches the most sensitive code an organisation has, so which access path you use is part of the decision.

What I would watch next#

Three things would tell us whether this becomes the standard way frontier models are sold.

The first is whether Anthropic's expansion to "a broader set of domestic and international partners" happens, how quickly, and on what terms. That decides whether trusted access is a global programme or a US one with exceptions.

The second is whether Fairwind publishes anything more concrete than categories: how long a decision takes, what a rejection looks like, whether there is an appeal. A programme that decides access to a capability is a governance process, and governance processes are judged on their transparency.

The third is the gap between tiers on the next release. If the general tier keeps loosening, as Fable 5.1 did with around 60% fewer safeguard interventions per Claude Code session, the split is doing what it promises. If the gap widens instead, the permissive tier stops being a specialist option and becomes the only version of the model worth using, and the vetting gate becomes the product.