Palo Alto rents out the cyber models Anthropic and OpenAI keep locked

The only way to buy a model the labs keep locked

Palo Alto Networks opened subscriptions on 22 September to Unit 42 Continuous Frontier AI Defense, an always-on offensive security service that runs Anthropic's Claude Mythos 5 and OpenAI's GPT-5.6-Cyber against customers' web apps, APIs, cloud and code ¹. After a full-estate scan it keeps testing as systems change, proposing code fixes or temporary "virtual" patches ⁴.

Neither model is sold to the public. OpenAI confines GPT-5.6-Cyber to Daybreak Red, its tier for offensive cyber work↗ ². Anthropic has kept Mythos out of general release because it finds flaws and chains them into working attacks too well to hand out freely ³. The price varies with the mix of Anthropic, OpenAI and open-weight models a customer chooses ⁴.

From export freeze to invoice line

The gate has a short, loud history. In June, Washington blocked Anthropic from offering Mythos 5 to foreign nationals and businesses; by late June, Commerce had cleared it for release↗ to "certain trusted partners" ⁵, and access returned on 1 July ⁴. In June, Mythos was a national-security risk. By September, it is a line on an enterprise invoice: Unit 42's Sam Rubin markets "exclusive access to gated capability models" ¹.

Anthropic built the resale template itself, launching Glasswing on 7 April↗ with $100M of API credits for roughly 50 partners, Microsoft and Apple among them ³. Rubrik holds the same gated-resale position, earlier in its cycle: Code Guardian runs Mythos 5 against an air-gapped copy of customers' code, in private preview ⁶.

A franchise re-accelerating under the moat

The pitch lands on a franchise that just sped up. Fiscal 2026 revenue reached $11.48B, up 24.5%, and next-generation security ARR stood at $8.13B, up 60% ⁷. Quarterly growth jumped from the mid-teens a year ago to 34.5% in the July quarter ⁸. Bernstein's 17 September downgrade to Market Perform↗, target $351, prices the other side: a $282M GAAP net loss and a stock that already assumes delivery ⁷.

Receipts, and 21,119 findings nobody checked

Palo Alto's numbers are company-claimed: six months and $17M across more than 100 engagements, exposures at every customer tested, 37% of them high or critical, and a year's worth of exposures on its own systems found in three weeks ⁴. The company also claims, without independent verification, that AI attackers compress breach cycles by almost 97%, from weeks to hours ⁴.

Independent audit cuts both ways. External reviewers confirmed 90.8% of the 1,900 checked Mythos findings, and one Linux kernel root exploit cost under $2,000 of compute ⁹. But 21,119 of 23,019 candidate bugs have never been reviewed outside Anthropic↗, and independent scorers called 13 of 27 CVE-rated findings overstated ⁹.

The labs say the channel is the safeguard

OpenAI's McCall McIntyre says Daybreak pairs the cyber models with "strong governance, and human judgment" ¹. Capability is the draw: OpenAI's own tests have GPT-5.6-Cyber completing 95% of a set of sensitive offensive requests, against 1.5% for the public model ².

The buyer's fear is blunter. "The Chinese will have Mythos next month. What do I do?" said Yevgeny Dibrov, ServiceNow's SVP and GM of cybersecurity and risk, calling it the top board-level concern↗ ¹⁰. That risk lands on everyone outside the gate: subscribers get their own attack paths checked, but the flaws sit in open-source software everyone runs, and most findings have never been checked outside Anthropic ⁹.

Palo Alto's November report will show whether the subscription adds ARR ⁷. What nobody will see is the split: the share of each subscription flowing back to Anthropic and OpenAI is not public.