On October 6, 2026, two labs answered the same dual-use cyber question in opposite ways. Anthropic expanded a tiered verification program so the locked default model stays locked and power lives behind an application form. Mistral shipped a 1-trillion-parameter open-weight preview whose sales pitch is that closed models refuse the exact work defenders need.
Same day, two doors
Call the first door Capability KYC: know-your-customer for model powers. The product you buy is a polite refusal. The product you apply for is the capability.
Anthropic published an expanded Cyber Verification Program that folds six months of Project Glasswing and the older CVP into three tiers. General models - Claude Opus 5.5, Claude Fable 5.1, Claude Sonnet 5.5 - keep conservative cyber safeguards that block most cyber work. Defenders who need more must qualify.
- Defense Access: SOC, incident response, malware reverse engineering, validating vulnerabilities on systems you own. Many orgs should qualify; review aims for a few days.
- Red Team Access: authorized pen testing added. Orgs only; weeks of review; still blocks ransomware-class and high-risk safety-system testing.
- Specialized Access: fewest cyber blocks, for flight systems, power grids, telecom, interbank rails, government nets. Reviewed with the US government. Glasswing members move here.
This is not a soft marketing ladder. Anthropic ran Claude Opus 5.5 on CyScenarioBench - multi-stage cyber ops under realistic constraints - with classifiers tuned per tier:
- No CVP: every task blocked on the first prompt.
- Defense Access: 46 of 50 trials blocked somewhere; four succeeded.
- Red Team Access: zero blocks; 34 of 50 completed - matching the models 67.6% rate with no safeguards (the Specialized Access shape).
The default product is a hard wall. The verified product is a measured unlock. Data retention is required so misuse can be correlated across time; Enterprise Frontier Safeguards later this fall is meant to restore customer-controlled storage without dropping the monitor.
What the locked door already bought
Glasswing was not empty theater. Between April and July 2026, partners uncovered at least 129,000 verified software vulnerabilities with Claude Mythos. Anthropics own open-source scanning added about 5,500 more through October. More than 33,000 of the verified set are critical or high severity - and Anthropic calls that a lower bound, expecting true impact at least five times higher from incomplete survey coverage. Partners said the same haul would have taken months or years without the models.
So the KYC door is not only risk theater. It is also a production channel: capability that is too dual-use for the public API still ships, just with identity, scope, retention, and a classifier ladder that can be measured.
The other door is a weight file
Hours earlier on the same calendar day, Mistral launched a public preview of Mistral Large 4 - unofficially ML4, officially le Chonk. It is a natively multimodal 1 trillion parameter model with 49 billion active parameters. Weights drop at the end of the month. Preview API is live now.
The cyber framing is blunt. On Artificial Analysis Cyber Index tasks that ask a model to reproduce a real open-source vulnerability and then patch it, ML4 scores 82%, the highest of any model Mistral cites. On Cybench it solves 93% of 40 CTF-style challenges. Several leading closed models, including Claude Opus 5.5 and GPT-6 Astra, score near zero on the reproduce-and-patch style test because they refuse.
Mistrals product claim is autonomy: provider-level refusals can block legitimate vulnerability research and incident response, and losing access mid-incident is itself a security risk. Open weights plus self-deployment put cyber work under the buyers own policy. Until weights ship, Mistral is still red-teaming with cybersecurity leaders, vetted partners, and state authorities under reduced moderation - a temporary Capability KYC of its own, then a permanent open file.
Permission is the new interface
The pattern is larger than cyber classifiers. The same day, TechCrunch reported that consumer agents - Meta Muse, Instinct, ChatGPT Dots - keep hitting website gates. Amazon has blocked Muse from its retail catalog. Walmart wants Muse traffic but human-check buttons still eject agents. Meta, Walmart, Stripe, Sierra, and others are drafting an open commerce protocol so good agents can be distinguished from spam bots. Flight carriers talk about unauthorized automation.
LibreOffice, also covered the same day, turned the opposite product decision into a feature: no AI in the default configuration, framed as privacy.
So the stack is splitting into three permission regimes at once:
- Lab KYC - who may run dual-use capability on a closed API (CVP tiers, life-sciences verification earlier).
- Site KYC - which agents may act on a retailer or airline.
- Open weights - skip the lab door, accept the ops and liability door yourself.
What changes if this holds
For security teams, the buying question stops being "do we have Claude or GPT?" and becomes "which tier are we on, and what does CyScenarioBench look like for us?" For CISOs who cannot wait for an application form, Mistral is selling the refusal gap as the reason to self-host. For product builders, agent features without a site-permission story will keep failing in the checkout flow.
The historical rhyme is export control and bank KYC, not model cards. Dual-use power is moving from a single public SKU to a paperwork ladder - unless someone ships the weights and lets the paperwork become your problem.
Two doors opened on October 6. One is an application form with a measured unlock table. The other is a weight file that treats refusal as the competitors bug. Which door your organization walks through is now a strategy choice, not a feature checkbox.