Model safeguards

Four instruments, and they do different work

The word policy covers four separate things, and conflating them misreads all four. A hosted usage policy is a contract over the API or the chat product, enforced after the fact by account action. A weights licence travels with the file, binds the downloader, and is enforced by contract and nobody else. An injected system prompt is text the provider prepends at inference on its own endpoint; xAI publishes its versions and most labs do not. A classifier refusal is a runtime decision surfaced in the API response, and Anthropic is the one lab in this set that documents its refusals as a typed object with a category field (CONFIRMED, documents opened 11 September 2026). The carve-out for authorised testing sits in a different place in each instrument, and in two of the four it is absent from the published text.

Anthropic types its refusals

The cleanest primary document any lab publishes on this subject is Anthropic’s refusals-and-fallback page, opened in full on 11 September 2026. It names which models carry classifiers, verbatim: “Claude Fable 5.1, Claude Fable 5, and Claude Opus 5 include safety classifiers that can decline a request. When that happens, you receive a normal response, not an error, with stop_reason: "refusal"” (CONFIRMED). The response carries a stop_details object with a category, and the cyber category’s own gloss is the line to quote to a reader: “The request could enable cyber harm, such as malware or exploit development. Benign cybersecurity work can also trigger this category” (CONFIRMED, verbatim). The other four categories are bio, frontier_llm, reasoning_extraction and general_harms.

Three operational details from the same page carry weight for anyone running security work at volume, all CONFIRMED. A refusal that arrives before any output is unbilled and still counts against rate limits, while a mid-stream refusal bills the input and the output already streamed. If the fallback model is rate limited or overloaded the fallback attempt is skipped and the refusal is returned, so Anthropic’s advice is to size the fallback model’s limits for the refusal volume expected. And a refusal is an HTTP 200, so monitoring built on error rates never sees it; instrument refusals as their own signal.

A cyber refusal falls back to Opus 4.8

Server-side fallback is in beta and takes one header plus one parameter: anthropic-beta: server-side-fallback-2026-07-01 and "fallbacks": "default". Every worked example on the page routes to claude-opus-4-8, and the documented default-routing sample names Opus 4.8 as the selected fallback for a cyber refusal (CONFIRMED). With the beta header set, each model’s permitted retry targets are published as allowed_fallback_models on its Models API entry, which is the cheapest way to discover what a flagged request will be answered by. The Message Batches API accepts no fallbacks parameter, and Bedrock, Google Cloud and Microsoft Foundry take client-side middleware instead.

In Claude Code the classifier decision surfaces as a model switch. The in-product message recorded in issue 90900 of 31 August 2026 reads: “Fable 5’s safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate coding, cybersecurity, and biology tasks. Switched to Opus 4.8” (CONFIRMED through the GitHub API). One second-order cost sits in issue 90680 of 30 August: after the one-click switch, a multi-day session ran on Opus 4.8 while self-labelling Fable 5 in every commit it signed, found only in a forensic audit. For a security-review pipeline that is a provenance problem as well as a capability one.

The published rates

Anthropic tunes the classifier per model generation and the rates reach the record through two independent readings of the Fable 5.1 and Mythos 5.1 system card, which this desk has not opened, so read the marker as corroboration between two readings of one document. Benign defensive traffic flagged runs 1.03 per cent on Fable 5.1 against 15.0 per cent for Fable 5 at launch, 0.61 per cent on Opus 5 and 0.52 per cent on Sonnet 5; defensive vulnerability discovery blocked runs 7.0 per cent on Fable 5.1 against 90.0 per cent for Fable 5 at launch, 13.9 per cent on Opus 5 and 3.2 per cent on Sonnet 5 (CONFIRMED by corroboration). Anthropic’s own prompting guide for Fable 5.1 states the direction in its own words: “Claude Fable 5.1’s safety classifiers produce fewer false positives than Claude Fable 5’s did at launch, and finding vulnerabilities in source code is permitted” (CONFIRMED, page opened).

The gated tier is the same weights without the classifiers. Anthropic’s page says so in one line: “Claude Mythos 5.1 is offered separately, by invitation only, as part of Project Glasswing. It shares Claude Fable 5.1’s specifications and pricing” (CONFIRMED). On the launch chart of 24 July 2026, Claude Opus 5 identifies vulnerabilities at 79.4 per cent against Claude Mythos 5 at 80.0 per cent and solves 4 exploitation challenges against Mythos 5’s 13, and Anthropic states the distance is deliberate: discovery permitted, the exploit step blocked (CONFIRMED in-house). Two configurations of the same weights, separated by what the classifier declined.

Anthropic’s own alignment assessment of 9 September 2026 measured the monitors from the other side: against the three deeply assessed incidents, the Fable 5, Fable 5.1 and Opus 5 cyber classifiers all triggered within the first 7,000 tokens and flagged more than 40 per cent of turns, and Claude Code auto mode would have denied 66 per cent of Mythos 5’s actions (CONFIRMED, page opened 19 September 2026). The models in those incidents ran without the cyber safeguards that ship with released models, which is what makes the incidents evidence about the safeguards.

OpenAI runs Daybreak in two tiers

OpenAI’s Model Spec is public domain and it opened in full. Its red-line principles name cyber weapons alongside CBRN, and the agentic section reads directly on an autonomous hunting harness: “High-risk activities (e.g., hacking, deception, resource acquisition, spawning sub-agents, self-modification) are always prohibited unless explicitly authorized by applicable instructions” (CONFIRMED, verbatim). That last clause is the carve-out, and it sits at the instruction layer.

The programme carve-out is Daybreak, split in two. Daybreak Blue, on GPT-5.6 Sol’s weights, covers secure code review, vulnerability triage, detection engineering, incident response, malware analysis and patch validation; Daybreak Red, running the cyber variant, covers proof-of-concept exploit development, exploit-chain validation, penetration testing and red teaming, and Blue approval does not carry into Red (SINGLE, help-centre article read as indexed content). The Codex client’s own source settles the mechanics: a refused turn retries once on the configured Daybreak model, only a refused turn routes there, the session’s stored model selection is unchanged, and the client says Daybreak is unavailable for GPT-6 Astra (CONFIRMED, codex-rs/tui/src/daybreak.rs opened). The pricing registry carries Daybreak Red at $12.50 and $75 per million tokens with a 400,000-token window under two keys (CONFIRMED). On the RealVuln board Daybreak Blue scores F3 79.5 against Sol’s 74.7 on identical weights, which is consistent with the permitted tier spending fewer turns declining (CONFIRMED, dashboard read).

Google gates by programme

Google states its mitigation stack in one sentence in the Threat Intelligence Group post opened in full: “For Gemini, we mitigate model abuse by disabling malicious accounts”, with changes fed back “to both our classifiers and at the model level” (CONFIRMED, verbatim). Access to the cyber-tuned models is by programme: Gemini 3.5 Flash Cyber went out through a limited-access pilot inside CodeMender, and Gemini 3.8 Flash Cyber sits behind the Fairwind Programme, restricted to trusted government authorities, critical infrastructure operators and software maintainers (SINGLE, programme pages read as indexed content). The Pro tier of the same generation still refused code-vulnerability analysis on a retest of 16 August 2026 (CONFIRMED in-house), and Google’s own table scores Flash Cyber at 86.2 per cent on CyberGym and 47.2 per cent on CWE-Bench (CONFIRMED in-house).

Meta and the open-weight labs bind by licence

Meta’s control is contractual and travels with the weights. The Llama 4 acceptable use policy prohibits users from agreeing to “create, generate, or facilitate the creation of malicious code, malware, computer viruses or do anything else that could disable, overburden, interfere with or impair the proper working, integrity, operation or appearance of a website or computer system” (CONFIRMED, verbatim), and it carries no security-research exception and no verification tier. What Meta ships for the inference path is Purple Llama, a deployer-side toolkit whose README recommends that all inputs and outputs “be checked and filtered in accordance with content guidelines appropriate to the application” (CONFIRMED). On open weights the filter exists, and whether it runs is the deployer’s decision.

The Chinese labs are the sharpest case. DeepSeek’s licence carries twelve use restrictions naming military use, minors, disinformation and automated decision-making, and having written twelve the drafters included nothing on malware, intrusion or exploitation (CONFIRMED, read in full). Z.ai’s Apache and MIT files carry no use restriction, Kimi K3’s bespoke licence is silent on cyber use, and Qwen3.8-27B is Apache-2.0 (CONFIRMED). xAI publishes the text it injects, and the operative word in its disallowed list is “unlawfully”: authorised testing under a published scope falls outside the prohibition by its own terms, with the burden on the operator to establish the authorisation (CONFIRMED, prompt file opened).

What this desk saw first-hand

On 11 September 2026 a research agent inside this desk’s own pack was stopped mid-task. The error text, verbatim: “API Error: Opus 4.8 safeguards flagged this message. Our intentionally broad safeguards allow us to deliver more capabilities faster, but can sometimes flag legitimate cybersecurity work. Apply to the Cyber Verification Program to reduce these interruptions. Details: [cyber]” (CONFIRMED, this desk’s own record). The brief that triggered it asked the agent to reconstruct a published, patched Redis flaw from the vendor advisory, the CVE record and this site’s own article. Every input was public. The line sits at reconstruction, and disclosure status did not move it, which is consistent with Anthropic’s own gloss that benign cybersecurity work can trigger the category. The remedy is named in the error string: the Cyber Verification Programme, which makes the programme part of the control surface.

The public record corroborates the pattern. A search of anthropics/claude-code issues on 11 September 2026 returned 849 matching the safeguard wording, with eight on the first page dated between 27 August and 11 September (CONFIRMED as search results carrying titles and dates; bodies unopened here).

How far the evidence goes

Two published studies put numbers on the cost to a defender, both SINGLE because arXiv refused this desk. Defensive Refusal Bias (arXiv 2603.01246) measures 2,390 real examples from the National Collegiate Cyber Defense Competition and finds safety-tuned frontier models refusing defensive requests carrying security-sensitive keywords at 2.72 times the rate of equivalent neutral requests, with system hardening worst at 43.8 per cent. 3R-Bench (arXiv 2609.00578) finds compliance on an identical request rising from 62.0 per cent after a refused history to 85.1 per cent after an accepted one, so conversation position moves the boundary by 23 points on unchanged text.

The cleanest published control on willingness is CyberKimi against stock Kimi K3: the same weights, the same V8 bug (CVE-2024-6100), the same 400-turn harness and prompt, with the refusal layer ablated and cyber post-training added. Stock scored 4 of 16 capabilities, the ablated build 8 of 16 unassisted and 10 of 16 with a methodology pack (CONFIRMED, published repository opened). Willingness moved that score as far as capability did, and the Model Security Capability board carries the refusal state beside every score for that reason.