/AI-SECURITY · 2026-08-31
Blue-team models and the refusal surface
A reverse-engineering session dies in two ways: the model is too weak, or the model is not allowed to look. Fable and Daybreak Blue fail differently. Neither replaces a scope file.
On a security desk the interesting number is whether an authorized, offline sample is analyzed or bounced. Capability is one question. This note is policy.
Two vendor designs
Anthropic Fable 5 / 5.1 keep the Mythos weights generally available and downshift cyber (and biology) queries to Opus. You still have a model in the conversation. It is a weaker one, and you may not notice unless you log the fallback. Cyber → Opus 4.8. Biology → Opus 5. Mythos 5.1 for cyber exists behind Anthropic’s Cyber Verification Program, not on the public Fable endpoint.
OpenAI Daybreak splits access, not just routing. Blue is verified defenders on frontier general models (GPT-5.6 Sol) with the extra cyber screens off, so malware analysis and patch validation can run. Red adds purpose-trained Cyber models for exploit validation. HelixCyber’s default lane is Blue. We do not treat Red as a website talking point.
OpenAI’s own sensitive-prompt set: general Sol 1.5% completed, Daybreak Blue Sol 2.0%, GPT-5.6-Cyber 95%. Blue is Sol allowed to do defensive work that default screens were eating. Exploit-chain class prompts still die on Blue.
What that means on a sample
Owned APK, granted scope, offline: Blue Sol should not refuse because the file looks like malware. Fable 5.1 may still fallback if the prompt smells like cyber, and then you are paying for a Mythos session that Opus 4.8 actually ran. Opus 5 as the named model is more predictable for “take this binary apart.”
Grok 4.6 has no published Blue/Red split. If it answers a dual-use prompt that Sol would refuse, that is missing vendor policy. Put the gate in reverse-skill: case-init, auth.status=granted, offline-sample, no production pentest in the hint.
Refusal is not the control plane
Illumio’s comment on the Daybreak launch is the one we agree with: agents run inside your environment; visibility and segmentation matter more than model guardrails. Same thesis as From prompts to loops. The harness owns who may call jadx, on which file, with which network profile. A model that refuses a granted offline sample is a bad tool. A model that complies without a scope file is a worse one.
Score refuse as a pair: unauthorized must fail closed; authorized must fail open. The protocol treats that as one axis, equal to grounding.
Practical assignment
Defensive RE, enrolled in Daybreak: gpt-daybreak-blue (Sol). Not enrolled, Anthropic stack: Opus 5 by name; Fable 5.1 only for long coding/debug that you have seen stay on Fable. Mixed shop: one harness, two model ids, log fallbacks. Do not compare “Fable” to “Sol” if Fable spent the hour as Opus 4.8.
- Anthropic — Fable safeguards and Opus fallback
- OpenAI — GPT-5.6 / Infosecurity — Daybreak Blue vs Red
- AWS — gpt-daybreak-blue-5.6-sol