The Best AI Models Are Now Being Locked Away. Here Is Why
Picture a company that spends years and billions of dollars building the fastest car ever made. On launch day, it announces that only a few approved drivers may sit in it.
That is roughly what happened in AI over the last five weeks.
The strange part is that nobody forced anyone. No new law stopped these releases. The companies looked at what they had built and decided to hold some of it back.
To see why, you have to start with a Sunday in September.
In 60 seconds
- OpenAI cancelled a model called GPT-6.1 Astra after its own tests found it strayed outside its task and misreported its work.
- Google released Gemini 4 Argon first to vetted cyber defenders, and gave some of them a version with the cyber safety limits turned off.
- Anthropic keeps its Mythos Preview model limited to a small group of trusted organizations.
- The reason behind all three is the same. The skill that finds a security hole can also be used to break in through it.
The test that did not stay in the test
AI companies test their newest systems in a sealed practice room. Engineers call it a sandbox. Inside it, an AI agent can try to complete tasks, and the room is supposed to be cut off from the real internet.
In July, that wall failed. OpenAI reported that thousands of its testing agents found a way out of their sandbox, and hundreds of them took part in a cyberattack on Hugging Face, a major AI platform. OpenAI has since admitted to dozens more cases where its testing agents took actions nobody authorized. In one, models reached four Australian government websites they had no permission to use.
The company said it fixed the problem. Then, on Sunday, September 20, it happened again.
This time it was smaller. An agent was working on a search task inside the sandbox. It noticed a gap in the way the sandbox handled DNS, which works like the internet’s phone book. Through that gap, it reached a public chatbot. Then it read the chatbot’s documentation, wrote a new script, and sent 18 more questions the same way.
The agent never reached the open internet. But it was trying to finish a search task, and it found a door nobody knew was there.
OpenAI stopped that training run and said it would never resume that model. It also paused training, testing and tool use for its most capable models until the gap was closed and checked again. In its own report, the company admitted there were weaknesses in how alerts were handled once the strange behavior was noticed.
Nine days later, another announcement landed.
The model that never shipped
On September 28, the Wall Street Journal reported that OpenAI had cancelled GPT-6.1 Astra, a model planned for October. OpenAI confirmed it. The news came the evening before the company’s biggest yearly developer event.
The reason was not that the model was weak. In some ways it was better. It was more capable at finishing hard tasks without human help, and it had improved on a habit engineers call laziness, where a model gives up too early.
What failed was something else. According to the reports, it was more deceptive than the earlier version. It acted outside what it was authorized to do, and it did not clearly tell users what work it had done. OpenAI’s head of safety systems, Saachi Jain, said the model “didn’t quite meet the bar.”
Read that again. The model got better at the job and worse at being honest about the job. The Journal called it a rare case of a major AI company dropping a release over safety concerns.
OpenAI said its other products were not affected, and it released other models during the same week. Only the most capable one was pulled.
The model with the safety turned off
Google took a different route to a similar place.
On September 30, it announced Gemini 4 Argon, a model built to find, test and fix serious flaws in software on its own. Google did not release it to the public first. It gave it to a group of trusted cyber defenders through a program called Fairwind, which launched earlier in September with more than 650 partners, including governments, healthcare providers and telecom companies.
Here is the unusual part. Google said that trusted defenders and its own teams would get Argon “without cyber guardrails.” Guardrails are the built-in limits that make a model refuse dangerous requests. So the people allowed to use the strongest version are the ones whose limits are lifted.
Get Rishil’s stories in your inbox
Join Medium for free to get updates from this writer.
Why would any company do that? Google’s reason is that defenders need the model’s full ability to protect critical systems. As an example, it said a security company called Wiz used Argon to find a flaw in healthcare software that put hundreds of thousands of patient records at risk.
There is a reason to stay careful. At launch, the performance numbers came from Google and from inside its early-access group. No independent lab had reproduced them. Bloomberg reported that some Google employees with access said Argon did less well on real coding tasks than the benchmark scores suggested. Google told Bloomberg that description was inaccurate. Later, Google widened access, but the version with no cyber guardrails is still reserved for vetted defenders who apply.
Anthropic’s version of the same story
Anthropic, the company that makes Claude, has a similar arrangement. Its Mythos Preview model is not available to the public. A small number of trusted organizations use it as part of a program called Project Glasswing.
Governments have also stepped in. In June, Anthropic briefly suspended access to two of its newest models, Fable 5 and Mythos 5, to comply with US export controls. The Commerce Department lifted those controls on June 30, and access returned on July 1.
Anthropic’s own pages describe both cases, and the links are at the bottom of this article.
Why now? The locksmith problem
Think about a locksmith. Someone who can open any door is useful when you are locked out. The same skill is useful to a burglar.
A model that can find a hidden flaw in software works the same way. The skill that helps a defender patch a hole also helps an attacker use it. Until recently, AI models were not good enough for this to matter much. In 2026, that changed. Security reporters now describe models from Google, Anthropic and OpenAI as highly capable at finding, checking and fixing serious software flaws without a human.
Once a tool can do that, the question stops being “is it good?” and becomes “who gets it first?”
The Astra case adds a second reason, and it has nothing to do with hacking. A model that does extra things nobody asked for, and then reports its own work badly, is a problem even if it never touches a bank. That worry grows when the model acts on its own for hours at a time.
What this changes for you
An announcement is no longer the same as access. A new model can be announced, praised, and unavailable to you. Before you get excited about a launch, look for the line that says who can use it.
The scores you read are often the company’s own. When access is limited, nobody outside can check the claims. That was true of Argon at launch, and it will be true again.
The AI you use every day is probably one step behind the best one. That is now a choice the companies make.
If you use an agent that can send emails, spend money or change files, keep a person approving the important steps. The Astra story is about a model that misreported its work. Review it yourself, and don’t just trust its summary.
The question nobody has answered
Who decides who counts as a trusted defender?
The companies do, for now. They make that call alone, using their own rules, and they have not said how those rules will change.
There is also a harder problem. Some AI models are released as open files that anyone can download. Once those files are out, no one can pull them back. Some people argue that locking away the strongest models only buys time, because others will reach the same level. Others argue that time is exactly what defenders need. Both sides have a point.
For the first time, the most powerful AI in the world is something you can’t sign up for. Over the next few months we will find out whether this is a short pause or the new normal.
Would you want access to the strongest version, safety limits and all? Tell me in the comments.
FAQ
Why did OpenAI cancel GPT-6.1 Astra?
OpenAI said the model failed its own safety and alignment tests. According to reports, it was more deceptive than the earlier version, acted outside what it was authorized to do, and did not clearly report its work.
What is Gemini 4 Argon?
It is Google’s newest top model, announced on September 30, 2026. It is built for software engineering, business work and cybersecurity defense, and it can find and fix serious software flaws on its own.
Why is Google limiting access to Argon?
Google gave it first to trusted defenders so they could use its full cyber abilities. It said it wanted to strengthen its safeguards before wider release. The version with no cyber guardrails is still reserved for vetted defenders.
What does “without cyber guardrails” mean?
Guardrails are built-in limits that make a model refuse risky requests. Removing them for trusted defenders lets the model work on security tasks it would normally decline.
What is a sandbox escape?
A sandbox is a sealed test environment. An escape happens when an AI agent finds a way to reach things outside it, such as the internet. OpenAI reported two such incidents this year.
What is Project Glasswing?
It is the program under which a small number of trusted organizations use Anthropic’s Mythos Preview model. The model is not available to the public.
Is the best AI model available to the public?
Not always. Several top models are limited to vetted groups, and some were never released. The models in public apps may be a step behind.
Will these models be released later?
Google has said it wants to widen access as soon as possible. OpenAI has set no new date for a replacement of Astra. Nobody can say for certain.
