Four labs shipped in four days. The gate is the product now.

The most important AI story on Saturday, September 5, 2026 is not any one launch.

It is the shape all four launches share. Between August 31 and September 3, OpenAI, Anthropic, Google, and Meta each shipped a flagship model, and each one drew a line around its most capable slice and put a program, a second model name, a workspace switch, or a waiting period in front of it. A Korean trade outlet, WOWTALE, summed it up on Saturday morning as four labs shipping "with the same catch." I think that is the right frame. The benchmark charts were the noise this week. The gates were the signal.

This week's earlier notes each took one lab at a time: Astra at Critical, the Gemini Flash and Flash Cyber split, Astra as a product with a toggle. Today I want to zoom out, because when four vendors independently make the same product decision in the same week, it stops being a vendor quirk and becomes the market. For a small team that already lets an agent touch a repo, a browser, or a customer record, that changes what a vendor memo has to say.

What the four labs actually did

I am staying with the primary posts and the workspace docs, plus the trade coverage that quotes them. I am not adding a roster or a date that a lab did not publish.

OpenAI launched GPT-6 Astra on September 3. Under its Preparedness Framework, Astra is the first OpenAI model rated Critical for cybersecurity, which in OpenAI's own words means finding and exploiting novel vulnerabilities in hardened targets without step-by-step human guidance. The publicly available version refuses offensive work such as writing proof-of-concept exploits. The most advanced cyber capabilities go first to vetted organizations in the application-based Daybreak program. On the seat side, OpenAI's workspace docs say that during the initial rollout an organization must have Daybreak access before an administrator can enable Astra at all, that Astra is off by default for ChatGPT Enterprise for the first two weeks, and that enabling it in a workspace does not grant API access. Plus and Pro seats get it as the rollout reaches them. (WOWTALE, ChatGPT Learn, OpenAI)

Anthropic introduced Claude Fable 5.1 and Claude Mythos 5.1 on September 1. Anthropic is unusually plain about it: they are the same model with different levels of safeguards. Fable 5.1 is generally available as claude-fable-5-1 on every platform. Mythos 5.1 is available only through trusted access programs, the Cyber Verification Program and the Life Sciences Verification Program, and for now only to a set of US organizations. Fable 5.1 can be used to discover software vulnerabilities but not to develop exploits, and dual-use tasks such as penetration testing, exploit generation, and binary vulnerability scanning still get redirected to Anthropic's Opus models. Anthropic says Claude Code users will see roughly 60% fewer cyber-safeguard interventions per session than on Fable 5. Pricing stayed at $10 per million input tokens and $50 per million output tokens, with cache reads cut 75% to $0.25, which Anthropic says lands at about 25% cheaper for typical workloads and up to about 45% for heavily agentic ones. One more detail worth filing: Claude Security, Anthropic's code-scanning product, is now powered by Mythos 5.1, so a team can consume the gated model through a product without ever holding Mythos access itself. (Anthropic)

Google published Gemini 3.8 Flash and Gemini 3.8 Flash Cyber on September 2. Flash is the buyable workhorse at the same introductory price as 3.7 Flash, $0.75 per million input tokens and $3.75 per million output tokens through December 31, 2026, then $1.50 and $7.50 from January 1, 2027. Flash Cyber shares the same foundation, carries a more permissive set of cyber mitigations, and is only available to trusted defenders through the new Fairwind Program for government authorities, critical infrastructure operators, and software maintainers. (Google, CNBC)

Meta released Muse Spark 1.3 on September 2 through Muse Code and the Meta Model API. Meta's gate was a reasoning tier rather than a program. The version that shipped runs at the xhigh setting. The higher-effort max tier, which is the one Meta's own scorecard uses for its headline numbers, stayed in a limited partner preview pending additional safety testing, per Artificial Analysis and The Decoder. Pricing for xhigh was unchanged at $1.25 and $4.25 per million tokens, and the model is not open-weight; Meta says a separate open-weights Muse Spark release is still coming. When I re-read Meta's launch page on Saturday, it had been updated to say Muse Spark 1.3 with max reasoning is now available, so that particular gate lifted within a few days. That is not a contradiction. It is the point: the gate is a dial the vendor turns, and your file has to keep up. (Meta, The Decoder, WOWTALE)

Four labs, four different mechanisms, one decision. In each case the vendor, not the user, decides who gets the most capable part of the model.

Why this is a small-team story

You are not going to join Daybreak, the Cyber Verification Program, or Fairwind this month. That is not the point.

The point is that "which model do we use" stopped being a single answer this week. The honest answer now has at least three parts: which model family, which tier or variant of it your seats can actually call, and which slice the vendor is deliberately keeping off your menu. A year ago the vendor memo had a price, a latency number, and a link to a safety page. This week every major vendor added a fourth thing, and none of them added it in the same shape.

OpenAI's version of the gate is a workspace switch plus a program. Anthropic's is a second model name. Google's is a separate variant behind an application. Meta's is a reasoning setting that shipped a few days late. If your operating notes still say "we use Claude" or "we're on ChatGPT Enterprise," those sentences were vague in August and are actively misleading in September, because two teams with that exact sentence can now have meaningfully different capabilities and meaningfully different permission surfaces.

The seat-level detail matters more than the program-level detail for most of us. Almost no five-person shop qualifies for a trusted-access program. Almost every five-person shop has a mix of individual plans, a workspace someone set up in 2025, and an API key in a CI secret. Those three surfaces now get different answers about the same model. OpenAI's docs say it directly: a model setting in the ChatGPT workspace does not apply to Codex CLI, the IDE extension, or the API, and enabling a model in a workspace does not grant API access. That is not OpenAI being difficult. That is OpenAI being accurate about a distinction the other three vendors are also drawing, just with less paperwork.

My analysis: the gate is the load-bearing object

I do not think a small team should try to grade the labs' safety cases against each other. You will not get a better product out of that argument. You can copy the structure the labs are forcing.

A model family is one object.

The tier or variant of it your seats can call is another.

The slice the vendor keeps behind a program is a third.

Those three can share a name in a menu. They are not the same procurement item, and they are definitely not the same permission set. Once four vendors say in the same week that the top slice is gated, the interesting question is no longer "did the evals move." It is whether anyone on your team can say, without opening a dashboard, which tier of which model your CI key calls and which tier your teammates' laptops call.

OpenAI's workspace docs have a line I would frame if I ran a security review practice: model access and runtime permissions are separate. A permission profile cannot grant model access, and model access cannot weaken the sandbox, the approval policy, or the network controls that apply to a run. That is the sentence this whole week resolves to. Vendors are now managing the first half for you, sometimes without asking. The second half is still entirely yours, and it does not get safer because the model you ended up with was the gated one or the ungated one.

The dates are part of the file too. Enterprise Astra is off by default for two weeks, then it is whatever your admin decides. Gemini 3.8 Flash doubles in price on January 1. Meta's max tier was gated on Tuesday and available by the weekend. Anthropic's Enterprise Frontier Safeguards start rolling out this fall, and eligible customers get zero data retention until then. None of those are permanent states. A vendor memo written on Wednesday and never touched again will be wrong about at least one of them by October.

I would rather be slightly dull here. One page per vendor. Model ID we actually call, and from which surface. Tier or effort setting we run. The slice that is gated and that we do not have, in the vendor's own words. Who on our side holds the toggle, if there is one. The dates that change the answer. That is a one-page access note. It is also the difference between a headline and a plan.

What I would do if I shipped agents this week

I would not switch vendors because one lab's gate looked friendlier than another's. All four are drawing the same line; they are drawing it with different pens.

I would open the real list of places a model gets called from: the coding agent in the IDE, the CI job, the support macro, the browser agent on the staging box, each teammate's individual plan. For each one I would write the vendor, the exact model ID, the tier or effort setting, and the sign-in path, because the sign-in path is what decides which gate applies. That is one afternoon of work and it is the part most teams have never done.

I would treat the gated slices as things I do not have. Not "we're on Claude, so we have Mythos-class cyber." We have Fable 5.1, which can find vulnerabilities and will hand exploit work to an Opus model. Not "we have Gemini." We have 3.8 Flash at the intro price, and Flash Cyber is a Fairwind product we would need a grant to see. Not "Astra is on." Astra is off in Enterprise until an admin with Daybreak access turns it on, and it is effectively on for anyone on an individual paid plan the day the rollout reaches them. Writing those sentences down is cheap. Discovering them in an incident review is not.

I would also separate the two conversations the labs just separated for us. One is access: which model and tier a seat can call. The other is permission: what an agent is allowed to click, spend, send, or deploy once it is running. The labs are getting more opinionated about the first and mostly silent about the second, because the second is your environment, not theirs. Write the confirmation rule for the four expensive verbs, and do not let a model upgrade, gated or not, quietly change it.

None of this requires you to cheer or to panic. Four labs shipped, four labs gated the top slice, and all four published enough detail to fill out a one-page note. Those sentences can be true enough for a small team to keep shipping while it writes its own page.

If you want help turning that into a real operating setup, start a project conversation.

Sources: WOWTALE, "OpenAI, Anthropic, Google and Meta All Ship New Models, With the Same Catch" (September 5, 2026), ChatGPT Learn, "Workspace model availability", OpenAI, "GPT-6 Astra: A new generation of intelligence" (September 3, 2026), Anthropic, "Introducing Claude Fable 5.1 and Claude Mythos 5.1" (September 1, 2026), Google, "Introducing Gemini 3.8 Flash and 3.8 Flash Cyber" (September 2, 2026), CNBC, "Google starts September with AI momentum after long losing streak" (September 2, 2026), Meta AI Research, "Introducing Muse Spark 1.3" (September 2, 2026), The Decoder, "Meta closes in on the top with Muse Spark 1.3, and undercuts rivals on price" (September 3, 2026)