Frontier coding models and cyber safeguards: public vs defender access

Three of the most capable coding models released in the past three weeks share a feature that matters to security teams: the version most people can use is deliberately restricted on offensive security work, and the less restricted version sits behind a separate application process. That is a reasonable design, but it creates a practical problem. A security engineer who asks a coding agent to analyse a binary or reproduce an exploit may hit a refusal, a silent switch to an older model, or neither, depending on which vendor, which surface and which programme the organisation has joined. This article sets out what each vendor has published and how to work out which tier your team is actually on.

What the vendors have said

Google: Gemini 4 Argon and the Fairwind Program

Google's Gemini 4 Argon announcement describes the public model as protected by a multi-layer defence stack that combines jailbreak resistance, monitoring and enforcement. Defender access is separate. Google says it is beginning an expansion to hundreds of additional Fairwind Program partners, and that cybersecurity defenders can apply to the programme for access to Argon without cyber guardrails, on a rolling basis. Fairwind is not open to everyone: it is an application, and access is granted to partners.

Anthropic: Sonnet 5.5, Opus 5.5 and Haiku 5.5

The Claude Sonnet 5.5 system card, dated 28 September 2026, says Sonnet 5.5 is deployed with cyber safeguards that enforce the same policy as Claude Opus 5 and Opus 5.5, and that users "should expect increased refusals with Sonnet 5.5, even on benign cybersecurity-related tasks". The key details:

• Like Opus 5.5, it uses three stages: a probe on the model's internal activations, a lightweight classifier and a separate trained classifier model.
• The policy allows vulnerability discovery in source code but blocks it in compiled binaries.
• On most interfaces, requests blocked by the cyber classifiers fall back to Claude Sonnet 5. This is automatic in Anthropic's own applications; on the API the developer must opt in, and traffic through other platforms and providers may behave differently.
• Some blocks, such as the classifiers against distilling the model's reasoning, have no fallback.
• For defenders, the card pointed to a forthcoming updated Cyber Verification Program. Anthropic launched it on 6 October: verified organisations can apply for one of three access tiers (Defense, Red Team and Specialized), each of which includes Sonnet 5.5.

Anthropic's Claude Haiku 5.5 announcement on 7 October places the smaller model in between. Its cyber safeguards are more restrictive than Haiku 4.5's but somewhat less restrictive than those on other recent models; they permit a wider range of defensive tasks than Sonnet 5.5's safeguards, but still block penetration testing and other techniques more likely to be used by attackers. The same page says organisations working on wider-ranging cyber activities can apply to the Cyber Verification Program.

OpenAI: GPT-6.1 Sol and Daybreak

OpenAI's system card addendum for GPT-6.1 Sol, published on 29 September 2026, says that under its Preparedness Framework the model is treated as Critical in cybersecurity, and therefore uses the same safeguards stack as GPT-6 Astra. Defender access goes through Daybreak, which OpenAI describes as a phased approach, with the stated goal of enabling more advanced authorised work over time.

On the client side, the Codex rust-v0.161.0 release, published on 7 October, makes Daybreak an explicit opt-in in the CLI. By default its controls are hidden and automatic cyber routing is off, and opt-in routing requires an eligible ChatGPT sign-in, the OpenAI provider and model and programme support. The article on Codex's default model change covers the rest of that release.

Where the differences bite

The three approaches have the same shape: a restricted public model, and a vetted track for defenders. The details differ in ways that affect day-to-day work.

What happens on a block. Anthropic's fallback means a blocked request may be answered by an older, less capable model rather than refused outright, but only in its own apps, or on the API if the developer opted in. A team comparing results across the Claude app and an API-based agent may see different behaviour for the same prompt.

What counts as restricted. Anthropic draws an explicit line between source code and compiled binaries. Haiku 5.5 and Sonnet 5.5 have different thresholds. The Google and OpenAI documents reviewed here describe their restrictions in less granular terms. Teams should not assume a task that works on one model will work on another.

Who decides access. Fairwind and Daybreak are vendor programmes with their own eligibility. Anthropic's expanded Cyber Verification Program, launched on 6 October, gives Sonnet 5.5 access only after verification. None of these are settings an engineer can switch on alone.

Safeguards are not guarantees. Google reports improved robustness figures for Argon, and Anthropic and OpenAI publish evaluation results, but none of the vendors claim the safeguards cannot be bypassed. Model-level restrictions are one layer, not a security boundary for your own systems. For controls that sit outside the model, see the article on sandboxing coding agents.

What it means for engineering and security leaders

The safeguards are aimed at offensive and dual-use security work, so the teams most likely to notice are application security, red teams, incident response and vulnerability research: exactly the people who most want strong models.

The practical risk is confusion. If nobody knows which tier the organisation has, security engineers may lose time to refusals, be tempted to route work through personal accounts, or get answers from a fallback model without realising it. A short internal note, per vendor, on which access tier you have and how blocks behave on each surface prevents most of that.

There is also a procurement angle. Defender programmes involve applications and vetting, which take time, so the decision to apply should be made before the work needs it.

Practical takeaways

• For each model vendor you use, record whether you are on the public tier or a defender programme (Fairwind, Cyber Verification Program, Daybreak).
• If you use Claude through the API, decide whether to opt in to cyber fallbacks, and tell security engineers which way you chose.
• Expect more refusals on binary analysis and offensive techniques with Sonnet 5.5, and test your real defensive tasks before rollout.
• In Codex, treat Daybreak as off until someone deliberately turns it on with the documented flag.
• If security engineers need Sonnet 5.5 or Opus 5.5 with fewer cyber blocks, apply to the expanded Cyber Verification Program early: Anthropic aims to answer Defense Access applications within a few days, and Red Team Access reviews take a few weeks.
• Keep your own controls, such as sandboxes and network limits, regardless of what the model refuses.

Where SpanDock fits

Vendor safeguards and your own organisation's policies are different things. SpanDock guardrails, on the Enterprise plan, are rules you set once on the server and that are enforced on each person's computer, such as blocking secrets or customer identifiers in prompts and tool calls. The matching runs on the computer itself, so prompt text never leaves it to be checked. For the Argon pricing details that sit alongside its safeguards, see Gemini 4 Argon is generally available.