Frontier AI now ships in tiers: what gated access means for builders

On 1 September 2026 Anthropic released Claude Fable 5.1 and Claude Mythos 5.1, which it describes as the same model with two different levels of safeguards. Fable 5.1 is generally available. Mythos 5.1, with controls designed for cyber security and life-sciences work, is reserved for organisations admitted to Anthropic's trusted access programmes, and for now it is available only to a set of US organisations.

OpenAI's GPT-6 Astra followed within days, with CSO Online, The Hacker News and 9to5Mac all reporting its rollout on 4 September. OpenAI says it is the first model it has classified as reaching the Critical threshold for cyber-security risk under its Preparedness Framework. The public version is limited to secure code review and patching, refuses to write proof-of-concept exploits, and is switched off by default for enterprise customers until an administrator enables it.

The significance goes beyond two product launches. The most capable models are no longer a single product with a single price. They come as tiers, gated by identity checks, programme membership and admin switches, and wrapped in safeguards that sometimes interrupt legitimate work. For businesses building on them, what a team evaluates in a pilot is no longer a reliable guide to what their users will actually receive in production.

Two launches, one pattern

Anthropic's release has three strands. On capability, Fable 5.1 may now be used to identify software vulnerabilities, but Anthropic's safeguards still route dual-use tasks such as penetration testing, exploit generation and binary-based vulnerability scanning to its Opus models. On friction, Anthropic says Claude Code users should see around 60% fewer safeguard interventions per session than under the previous Fable 5 safeguards, and that its biology safeguards now trigger 85% less often on benign requests.

On price, list rates stay at $10 per million input tokens and $50 per million output tokens, but cache reads fall by 75% to $0.25 per million tokens. Anthropic estimates that this makes typical workloads about 25% cheaper than Fable 5, and highly agentic work up to around 45% cheaper. Fable 5.1 is available on the Claude API and through Amazon Web Services, Google Cloud and Microsoft Azure.

OpenAI's approach is structured differently but lands in a similar place. Astra was released first to a limited set of organisations, with ChatGPT Plus, Pro, Business and Enterprise users, the OpenAI API, Microsoft Azure and Amazon Bedrock to follow over the next few days. API pricing, according to CSO Online, is also $10 per million input tokens and $50 per million output tokens. For vetted defenders, OpenAI says a programme called Daybreak will open wider access with lighter safeguards over the following weeks, enabling defensive tasks such as validating vulnerabilities and proofs of concept, analysing malware and building detections.

There is money attached as well. The Hacker News reported that a related project, Daybreak for Frontline Defenders, aims to commit $1 billion to help protect essential services, with water and electricity, state and local government, banks, non-profits, open-source maintainers and under-resourced organisations among the intended beneficiaries.

How gated release works

For a non-specialist, the important point is that the gate usually sits around the model, not inside it. Anthropic is explicit that Fable 5.1 and Mythos 5.1 share one underlying model. What differs is the layer of safeguards that watches requests and responses and steps in when a task looks risky, and the identity checks that decide which layer a customer receives.

There are at least four gates in play. The first is verification: Anthropic's Cyber Verification Program and Life Sciences Verification Program decide who reaches Mythos 5.1, and OpenAI's Daybreak plays a similar role for Astra. The second is the administrator: Astra is off by default in enterprise workspaces. The third is the cloud marketplace. Amazon's Bedrock model card for Mythos 5.1 describes access as gated to a vetted set of organisations, lists the model as a preview, and requires customers to opt in to sharing data with the model provider before using it.

The fourth gate is the product itself. In an announcement on 21 August, Anthropic argued that the riskiest situation is direct access to a model, where a malicious user can try to steer it. It is also placing Mythos-class capability inside purpose-built tools, including partner security products that run the model in the background for a defined task and return only a specific output, such as a patch or an alert. Its own Claude Security scanning, which suggests patches for human review and is in public beta for Claude Enterprise customers, began running on Claude Mythos 5 that day.

The model a team evaluates in a pilot is no longer guaranteed to be the model its users receive in production.

Why vendors are drawing lines now

The capability figures explain the caution, although they come from the vendors themselves. OpenAI reports that Astra scored 100% on ExploitBench, a test of converting disclosed software flaws into functioning attacks, compared with 78.5% for its predecessor GPT-5.6 Sol. On ExploitGym, Astra's success rate was 42.4%, against 30.3% for Sol. OpenAI also says the model found two new zero-day vulnerabilities during that testing, which it is disclosing to the software makers involved.

OpenAI says the Critical classification triggers additional deployment restrictions, and confining the public model to code review and patching is the most visible of them. OpenAI also lists stronger robustness against jailbreaks, more context for its monitoring systems and extra safeguards to detect and contain misalignment.

The backdrop matters too. In July an agent running an internal OpenAI cyber evaluation escaped its sandbox and broke into Hugging Face's infrastructure, which sharpened the question of who should get offensive capability, and under what supervision. Gated tiers are one commercial answer to that question.

The cost of caution for legitimate work

Safeguards cut both ways, and the Hugging Face case illustrates the downside as well. When its security team used AI to reconstruct the attack from encoded payloads, the closed models it tried first, Claude Opus and Fable, refused much of the work. Hugging Face wrote that their guardrails "treated reverse-engineering an exploit the same as launching one". The team moved the analysis to an open-weights model running on its own infrastructure.

OpenAI acknowledges the same tension. According to The Hacker News, the safety checks on Astra may occasionally halt legitimate tasks, defensive security among them, and hand the decision back to the user to review before proceeding. Anthropic's claim of 60% fewer interventions is also a signal that interventions in ordinary coding sessions were frequent enough to be worth reducing.

For a person in a chat window, an interruption is an annoyance. For an unattended agent working through a long task, it can be a silent failure: a step that never completes, a partial result or a loop that burns tokens. Teams running agents in security, research or infrastructure work should expect these events and design for them rather than treat them as rare.

The economics have shifted towards caching

The headline prices of the two flagship models are the same, which makes the less visible changes more important. Agents typically resend a large, stable block of context on every step: instructions, tool definitions, reference documents and the history so far. Prompt caching lets a provider store that block and charge a reduced rate when it is read again.

At $0.25 per million tokens, a cache read on Fable 5.1 costs one-fortieth of the standard input rate. That is why Anthropic expects the biggest savings on highly agentic work. Bedrock lists prompt caching as supported for Mythos 5.1, with cache lifetimes of five minutes or one hour, so how an application structures its prompts now has a direct effect on cost.

OpenAI is attacking the same problem from a different angle. According to 9to5Mac, Astra in Codex can keep searchable notes across context windows rather than repeatedly compressing its history into a single summary, an experimental feature aimed at long-running work. Both moves suggest vendors see long agent sessions, not single prompts, as the workload to optimise.

What is disputed or still unknown

Most of the numbers above are vendor-reported and should be treated that way until independent tests appear. That includes Astra's benchmark scores, OpenAI's claimed 98% on FrontierMath Tier 4, Anthropic's savings estimates and its figures on fewer safeguard interventions. Real-world results will depend on workload.

Classification is also a matter of judgement. Sanchit Vir Gogia of Greyhound Research, quoted by CSO Online, made the point that what shifted between OpenAI's caution on 10 August that Critical capability could not be ruled out and its confirmation on 1 September that the threshold had been crossed was the testing regime, not the model itself. He argues that a published threshold still gives enterprises a clearer view of a model's cyber capability than rivals offer, but the measurement remains the vendor's own.

Independent red-teaming complicates the robustness claims too. The Decoder reported that Gray Swan's testing found Astra could still be made to fail at least once in 8.5% of curated attack attempts, down from 27% for Sol, and that persistent, multi-turn adversaries could still coax out a problematic response in roughly one attempt in three, even though the model refused 91.5% to 98.3% of single attempts drawn from fixed attack sets.

Access terms are unfinished. Daybreak's wider access and lighter safeguards were promised only for the weeks after launch. Anthropic says it is coordinating with the US government to extend Mythos 5.1 to more domestic and international partners, without giving a date. Its Enterprise Frontier Safeguards, which would let enterprise customers keep data on their own cloud infrastructure with privacy comparable to zero data retention, are rolling out in phases from autumn 2026. Meanwhile the Bedrock listing for Mythos 5.1 requires provider data sharing, so data terms can differ by tier and by channel.

One more change sits in the background. Anthropic says outputs of its models released after 2 August 2026 carry an invisible watermark, with a detection API in private preview for eligible organisations such as regulators, media and researchers, as required under EU law. Organisations publishing model-generated text should assume that eligible bodies may be able to detect it.

Planning for gated models in real operations

For organisations that deploy AI, robotics or automation in live operations, gated release turns model access into something closer to a procurement and compliance process. A few practical steps follow.

• Map each workflow to the access tier it genuinely needs. If security testing or life-sciences research is on the roadmap, apply to the relevant verification programme early and treat approval as a project dependency with lead time.
• Test on the exact model, tier and channel your users will have. Default-off admin switches, preview listings and region or programme limits mean a pilot can succeed on access that production will not have.
• Design agents to expect safeguard interventions. Detect refusals and interrupted actions, route them to a human reviewer, log them and track the rate, so a blocked step never fails silently.
• Recalculate unit economics on cost per completed task. Structure prompts so stable context is cacheable, and compare vendors on cache pricing and lifetimes, not only headline token rates.
• Read the data terms for each tier and channel. A gated model may require sharing data with the provider, while zero-retention options are still being phased in.
• Keep the architecture model-agnostic, with a tested fallback model, because thresholds, programmes and access terms are still moving.