# Why do the most capable AI models launch to limited groups first?

Date: 2026-11-02 · Author: Robert Scales · https://guidetoartificialintelligence.com/en/learn/why-top-ai-models-launch-limited-groups/

**Answer:** Labs hold back their strongest cyber-capable models because the same skills that find and fix software flaws can also be used to attack, so they try to give defenders a head start and test safeguards first. Critics reply that this only buys time, leaves smaller organizations behind and hands private companies power over who gets protected, and open-weight models are already narrowing the gap.

In ordinary software, a limited launch usually means a capacity problem or a marketing plan. In frontier AI this year, it has come to mean something else: a company has built a model it believes is too risky to sell to everyone on day one, at least until protections catch up.

The trigger is cybersecurity. Models that improved at coding have also improved at finding flaws in software and writing working attacks against them. Anthropic says that in Mythos's case the ability grew out of general skill at code and reasoning, not training aimed at hacking.

## How the labs have done it

| Model | Announced | First access | Then |
|---|---|---|---|
| [Claude Mythos Preview](/en/learn/what-is-claude-mythos-preview-and-project-glasswing/) (Anthropic) | April 7 | Launch partners and about 40 other organizations in Project Glasswing | Roughly 200 participants by June, [BetaKit reports](https://betakit.com/canadian-government-gains-access-to-anthropics-powerful-mythos-model/) |
| [GPT-5.5-Cyber](https://openai.com/index/gpt-5-5-with-trusted-access-for-cyber/) (OpenAI) | May 7 | Vetted defenders of critical infrastructure | Part of a tiered Trusted Access for Cyber program |
| [GPT-6 Astra](/en/learn/what-is-gpt-6-astra/) (OpenAI) | September 3 | A limited set of organizations | Paid users and the API within days, with advanced offensive tasks refused |
| [Gemini 4 Carbon](/en/learn/what-is-gemini-4-carbon/) (Google) | October 28 | A subset of defenders in the Fairwind Program | Partners, then the public; no dates given |

These are not one policy. "Limited" can mean a closed group for months, or a pause of a few days. And the limits now often apply to one ability, not to the whole model. OpenAI's [GPT-6.1 Terra](/en/learn/what-is-gpt-6-1-terra/) is rated Critical for cyber on OpenAI's own scale, yet it went straight to paying customers, with safeguards in place.

## The case for holding back

The main argument is about timing. Finding and fixing a flaw takes time: someone must write the patch, then millions of systems must install it. If attackers and defenders get a powerful tool on the same day, attackers may gain more, since they need one unpatched system while defenders must fix them all.

So a period of limited access has concrete goals:

- **Fix the most important software first.** Anthropic says Glasswing participants found over 10,000 vulnerabilities in critical software. That's the company's own figure.
- **Test the safeguards on real work.** Google says it wants feedback and better guardrails before Carbon reaches the public.
- **Let governments look first.** Google says it's taking part in the U.S. government's voluntary pre-release testing.

The approach can have a real cost for the company. Anthropic's [IPO filing](/en/learn/anthropic-s1-ipo-filing-numbers/) says limiting Mythos may have hurt its short-term revenue, and warns that such measures could slow it relative to competitors without similar limits.

## The case against

Each of these criticisms has force.

**It only buys time.** Just Security argued in May that restricting Mythos may slow the spread of this ability but won't stop it. By September, there was evidence for that view. A U.S. government lab, NIST's Center for AI Standards and Innovation, assessed GLM-5.3 from China's Zhipu AI as the most cyber-capable open-weight model so far, about four months behind the U.S. frontier on its cyber tests. Open-weight means anyone can download and run it. Anthropic's own tests found its safeguards could be bypassed 64% to 100% of the time with simple techniques. Anthropic is a competitor, so its framing deserves some care, though it says its capability findings broadly match the government's.

**It leaves most organizations out.** Just Security also points to schools, hospitals and utilities that can't afford top-tier defences or replace old systems, and warns that they may be pushed toward large cloud providers.

**It concentrates power.** A handful of companies decide who gets protected first, and governments can intervene too. That can look different from outside the United States. Canada's Centre for Cyber Security gained Mythos access with the June expansion, and Anthropic wouldn't tell BetaKit which Canadian organizations were on its list. Jon Ferguson of the Canadian Internet Registration Authority told BetaKit that Mythos shows Canada's exposure without sovereign AI capacity. Anthropic's filing also says U.S. export restrictions in June led it to disable Fable 5 and Mythos 5 for all customers until they were lifted.

**It doubles as marketing.** BetaKit reports that some critics call the Mythos limits a ploy to make the product seem indispensable. A claim that a model is too dangerous to release is also a claim that it is very good, and it can't be fully tested from outside. Anthropic's filing itself lists, as a risk, that coalitions like this could be perceived as exclusionary or anticompetitive.

## A way to weigh a limited launch

When the next announcement arrives, these questions are more useful than the headline:

```prompt
Here is an AI company's announcement of a limited model release: [paste text].
Answer from the text only, and write "not stated" when it doesn't say:
1. Who gets access first, and how are they chosen?
2. What specific risk justifies the limit?
3. Which test results support that risk, and who ran the tests?
4. What must happen before access widens? Is there a date?
5. Is there support for those without access, such as credits or free tools?
```

> **Try it:** Run this prompt on the [Gemini 4 Carbon announcement](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/), then on [Project Glasswing](https://www.anthropic.com/glasswing). Compare how many answers come back as "not stated."

## What can a small organization do while it waits for access?

Most of the useful work doesn't need a restricted model. Since attackers may soon have similar tools, the priority is to shrink the time between a fix being published and being installed. That means turning on automatic updates, replacing devices and software that no longer get fixes, knowing what you have connected to the Internet, and keeping tested backups. [Our security checklist](/en/learn/cyber-capable-ai-models-mean-own-security/) goes through these steps.

You can also use widely available models for defence. Ask one to review your own code or configuration for common mistakes, while you keep human judgment on what to change. If you maintain open-source software, look into the programs labs run for maintainers: Anthropic's Glasswing included donations to open-source security groups, and OpenAI offers selected maintainers conditional access to Codex Security.

None of this requires an invitation to any company's program.

## Sources

- Gemini 4 Carbon: https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-4-carbon/
- GLM-5.3 and the spread of advanced cyber capabilities: https://www.anthropic.com/research/glm-5-3-and-the-spread-of-advanced-cyber-capabilities
- Too Dangerous to Deploy: Anthropic's Mythos and What Comes Next: https://www.justsecurity.org/138011/too-dangerous-anthropic-mythos/

---

From the Guide to Artificial Intelligence, by Robert Scales, published by Holistic Hybrid Inc. Share and adapt it under CC BY-NC-SA 4.0 (https://creativecommons.org/licenses/by-nc-sa/4.0/): credit the guide, link to https://guidetoartificialintelligence.com/en/learn/why-top-ai-models-launch-limited-groups/, no commercial use without permission, and keep the same licence.