Three Cyber-Capable AI Models in 72 Hours — What to Do Now

What the public models now refuse

This is the part that hits ordinary developers first. On Fable 5.1, defensive vulnerability discovery is permitted but exploit generation, penetration testing and binary vulnerability scanning are redirected to Opus models; a real-time classifier watches for probing, sandbox-escape attempts and unexpected internet access. Anthropic says cyber interventions per Claude Code session dropped about 60% versus Fable 5 because the classifier is more precise — but the categories are still blocked. On Astra, OpenAI states outright that safeguards “may erroneously flag legitimate activity”.

Practical implications. If your CI runs an AI step that writes exploit-shaped tests — fuzzers, proof-of-concept scripts for your own bug bounty — expect refusals and route those steps to a model or programme that permits them. If you maintain security tooling, apply to Fairwind or Daybreak Blue now; general-API access is not coming back for that category. And if you rely on reading the model’s chain of thought to audit what it did, Astra just made that weaker.

The attacker side of the ledger

Astra’s 100% on ExploitBench and Flash Cyber’s 70% real-world discovery rate describe tools that defenders get through programmes and attackers get through leaks, jailbreaks or open-weight catch-up. The honest planning assumption for anyone with an internet-facing app: autonomous discovery of unknown vulnerabilities in your stack is now cheap for a well-resourced adversary, and the time between a bug existing and a working exploit existing is measured in hours of compute rather than weeks of human effort.

That collapses the patch window. The Next.js 16.3.3 security release in August, the MCP CVE classes we catalogued in our MCP server security audit, and the first fully agentic cyberattack traced by Sysdig earlier this year all point the same way: unpatched known issues are the surface that gets hit first, because a model does not need a zero-day when your dependency lockfile is six months old.

Five things to do this month

Patch cadence to days. Automate dependency updates for anything that faces the internet and merge security releases within 48 hours. If you run Next.js, 16.3.3 or 15.5.24 is the floor.

Assume credentials leak. Two of the three Anthropic incidents ran through exposed credentials. Rotate anything that has ever touched a CI log, use short-lived tokens, and treat any secret an AI agent could read as public. The password strength checker and JWT decoder are useful for the audit; the fix is scoping, not stronger strings.

Sandbox your own agents. The AISI runs are what a Claude Code or Codex session does with internet access and no guardrails. Run agents in containers with egress allow-lists, no long-lived cloud credentials and a tool-governance layer. The ATGM tool-governance kit is the framework we use to decide which tools an agent may call unattended.

Decide your model policy in writing. Which model may see production data, which may reach the internet, which may write to package registries. Put it in CLAUDE.md or AGENTS.md so it applies to every session — the production rule pack has a trust-boundary rule file you can adopt as is.

Enter the programmes if you defend software for a living. Fairwind and Daybreak Blue are where the defensive capability lives now. Anthropic’s Enterprise Frontier Safeguards — monitoring data kept in your own cloud, customer-managed keys, no separate fee — rolls out this autumn for organisations that need the audit trail.

Quick answers

Can I still use Claude or GPT for security work?

Defensive work, yes: vulnerability discovery on code you own, hardening, code review. Exploit generation, penetration testing and binary scanning are restricted on the public models — Anthropic redirects those to Opus with its own limits, OpenAI routes them through Daybreak Blue. Apply to the programmes if that is your job.

What is Fairwind?

Google’s programme for trusted defenders, with more than 650 partner organisations including CrowdStrike, Datadog, Palo Alto Networks, Menlo Security and Snowflake, plus governments, telecom, healthcare and Google Cloud customers. It is the only route to Gemini 3.8 Flash Cyber.

What is Daybreak Blue?

OpenAI’s access programme for deep cyber use of GPT-6 Astra. General API access to the model is subject to layered classifiers that OpenAI says may flag legitimate security activity.

Did the July incidents cause real damage?

The UK AI Security Institute found no resulting real-world harm from its 122 runs. Anthropic’s own incidents did involve real access — a production database, a malicious PyPI package executed by fifteen systems — and were disclosed on 30 July with the remediation steps.

Which Next.js version should I be on?

16.3.3 on the Active LTS line or 15.5.24 on Maintenance LTS, after the August 2026 security release. Our Next.js 16.3 guide covers the upgrade.

For the individual model details, see the GPT-6 Astra developer guide, the Gemini 3.8 Flash guide and the Claude Fable 5.1 pricing breakdown. Every product mentioned is available at wowhow.cloud — pay once, ship forever.