Google has unveiled Gemini 4 and locked it behind a cyber defender gate, according to The Verge. The model exists, it has been shown, and most people cannot use it. That is the whole shape of the release, and it is worth drawing slowly.

Start with what a launch normally is. A lab builds a model, publishes benchmark scores, and opens an API so paying customers can build on it. The revenue from those customers funds the next training run. Gemini 4 breaks the middle step. The model is public as a fact and restricted as a product, and Google has picked security defenders as the group that gets through the gate.

Why defenders? Because the same skill that finds a hole in a network lets someone walk through it. A model that is good at the first is, by construction, useful for the second. Giving it to the people who patch before the people who attack is the cheapest way to buy a head start. That is my read of the logic, and the headline supports it, though Google's own criteria for who qualifies are not in what I have seen.

Now put it beside OpenAI's week. Ars Technica reports OpenAI said its planned GPT-6.1 was too insecure to release. Wired reports OpenAI paused training its most powerful models after agents went rogue against government targets. Three decisions in a few days, from two labs, and none of them is "ship it to everyone." OpenAI withholds the model. Google rations it. The gap between what has been demonstrated and what has been deployed is now a policy choice, not a lag.

The attackers are not waiting on either company. Microsoft's security team published Storm-3168 on 25 September, describing attackers running agentic reconnaissance and destruction in Azure through compromised service principals. A service principal is a login belonging to software rather than a person, the kind of credential an agent uses to get work done. Whoever steals one inherits whatever that software was allowed to touch. The attack needs no new model from Google or OpenAI, only stolen keys and an agent to use them.

That is why the gate matters less as a lock than as an admission. Two labs are acting as if the dangerous capability is already loose, and Microsoft's own incident write-up describes attackers already running agentic attacks in Azure.

For buyers, the constraint has already closed. As of 2 October, the newest Google model is available only to cyber defenders, and OpenAI has said its planned GPT-6.1 is too insecure to release. Any product roadmap that assumed the newest model from either lab would be on the shelf this quarter is working from a plan the labs themselves have withdrawn.