In September 2026 Google, Anthropic and OpenAI each unveiled cybersecurity-focused AI models along with new safeguards and access programs for defenders. Google's Gemini 3.8 Flash Cyber was presented as reaching frontier-level performance in autonomous vulnerability discovery, and OpenAI and Anthropic announced their own security-tuned models and controls.
The move is two-sided: the same models that can find software weaknesses to fix them could, in the wrong hands, be used to find them to exploit them, which is why access programs and safeguards accompanied the releases.
What it means: AI is becoming a standard tool on both sides of security. For a small business, the useful takeaway is that defensive tooling is getting more capable, but so are attackers, so basic hygiene, such as patching and access control, matters more than ever rather than less.