OpenAI and Anthropic just made opposing bets on the same problem: what to do when your AI model can find serious vulnerabilities in software that defenders and attackers both want to exploit.
Within eight days of each other, the two labs announced cyber-focused AI models built on the same underlying insight. These systems can analyze compiled software, find holes, and help patch them. That is genuinely useful for security teams. It is also, by any honest reading, useful for people who want to break in.
The labs responded differently. Anthropic locked Mythos behind Project Glasswing, a controlled access program for vetted organizations. OpenAI is doing the opposite: expanding its Trusted Access for Cyber program to thousands of verified defenders, adding tiers where more powerful models unlock at higher verification levels.
"We don't think it's practical or appropriate to centrally decide who gets to defend themselves," OpenAI wrote in its blog post. That framing is doing real work. It sounds like an argument for democracy. It is also an argument for speed.
The timing is not accidental. Anthropic announced Mythos on April 7. OpenAI announced GPT-5.4-Cyber on April 14. Both models landed in the same capability band: capable enough that their creators drew the same red line. OpenAI classified GPT-5.4 as high cyber capability under its Preparedness Framework. That is the same internal designation system that Anthropic uses for models it deems too risky for general release.
OpenAI's post makes the case for moving fast explicitly. It cites threat actors already eliciting stronger capabilities from existing models using test-time compute techniques. "Safeguards cannot wait for a single future capability threshold to be the trigger for action," the post states. The argument is that the attackers are not waiting, so the defenders cannot afford to either.
The track record OpenAI points to is real. Codex Security has contributed to more than 3,000 critical and high-severity vulnerabilities fixed since its broader launch. That is a concrete number attached to a real outcome. OpenAI has also reached more than 1,000 open source projects with free security scanning through Codex for Open Source.
But the counterforce is not hypothetical. The same binary reverse engineering capability that lets a defender analyze a piece of malware without source code also lets an attacker do the same thing. GPT-5.4-Cyber is trained to be permissive for legitimate security work, which means it has lower refusal boundaries than the base model. Those boundaries are the only thing standing between the model and someone with a less legitimate purpose.
Zero-Data Retention adds another complication. Organizations accessing GPT-5.4-Cyber through third-party platforms face restrictions on data visibility, which OpenAI says are meant to protect user privacy. For security teams, that visibility is often exactly what they need to verify whether the model found something real or generated a false positive.
There is a deeper question that neither company is really answering: does the containment strategy Anthropic chose actually work, or does it just delay the inevitable? If a model with these capabilities exists anywhere in the wild, the information needed to replicate or approximate it flows through the same research community that both labs draw from. OpenAI's posture assumes that getting there first with safeguards is better than letting the capability propagate without them. Anthropic's assumes the opposite.
The competitive pressure between the two labs makes this harder to resolve as a pure safety question. OpenAI's post explicitly notes it is preparing for increasingly capable models in the coming months. Anthropic is not standing still. The race is real, and the labs are not pausing it to wait for consensus on what responsible release looks like.
What to watch: whether any security researchers who have used both Mythos and GPT-5.4-Cyber start publishing comparisons. The actual capability gap, if there is one, will show up in what defenders can actually do with each system. And whether the third-party access constraints on GPT-5.4-Cyber create enough friction that the open-weight models which will inevitably replicate these capabilities become the actual battleground.
