The latest
The debate over frontier AI access is obscuring a simpler truth, cybersecurity experts told Axios: most companies can defend themselves adequately without it. While the Trump administration locks down the most powerful models and smaller firms face prohibitive costs, security professionals say the real gap isn’t model access — it’s basic cyber hygiene.
Details
• The Trump administration suspended access to Anthropic’s Mythos 5 before allowing a limited release to government-approved organizations last week. It also asked OpenAI to restrict its GPT-5.6 model to a controlled preview, citing national security concerns. Anthropic is still negotiating the terms of Fable 5’s release.
• A real-world test undercuts the case for frontier-model dependency: AI security firm Aisle found six of 18 recently disclosed vulnerabilities in the widely used Curl open-source library. Mythos Preview — a far more advanced model — found just one.
• Phil Venables, a partner at Ballistic Ventures and former Google Cloud CISO, told Axios that most companies can start hunting for bugs today using lower-cost models. “If you were at a company that panicked because you couldn’t get access to Mythos, you just went home to GPT or Claude Opus or Gemini or whatever and ran it against your code base and freaked out anyway because you found a ton of vulnerabilities,” he said.
• Cybersecurity firms are increasingly building multi-model AI systems that combine proprietary and fine-tuned open-source models trained on specialized security expertise — cutting costs sharply compared to brute-force frontier approaches.
• Morgan Adamski, a principal at PwC’s cyber, data and technology risk practice, said many mid-market companies lack the resources to keep pace with AI-powered threats — but that the answer is doubling down on fundamentals: zero-trust data access, updated identity management, and active vulnerability management programs.
What to watch
Experts broadly agree that AI will deepen existing security gaps rather than create entirely new ones — which means companies that haven’t locked down the basics are the most exposed. Access to frontier models matters less than whether a company has the discipline to fix what it already knows is broken.
