They Matched The Slogan. The Decision Lived In The Undefined Word

Part two of: OpenAI Says Verified Defenders Get More Access. I'm Going to Test That.

Part I started because I got refused.

Not in a dramatic way. I was doing authorized defensive work, and the model wouldn't follow me into it. Twice, across two providers. The question I actually asked — the one that turned into a research lane — wasn't why did this happen to me. It was narrower and more annoying: what is the threshold? Somebody decided where the line sits. I wanted to know who, and on what basis.

Part I built an instrument to measure that, published the design, and watched it fail its first independent break before collecting a single data point.

Part I also ended with a promise:

Part two examines the people who built this: what they said the future should be, and what they actually shipped. Same standard for everyone, including the ones I respect.

This is that piece. It is not a prosecution. It is six ledger rows — dated words against dated actions. Rows 1–5 were written before the prose. Row 6 was discovered during a primary-source depth pass, entered the article first, and only then added to the ledger. That broke the construction order. I am naming it here rather than rewriting the history to make the gate look satisfied.

What the ledger returned, under one domain and one sourcing method:

In these six rows, I did not need a lie to explain the tension. The consequential choices I could trace lived inside phrases nobody had operationally defined at the podium.

The instrument, and why its rules are boring

The rules exist because I broke them first. Each one is named after the mistake that produced it.

A pledge is not an action. Row 2 taught this. I scored "I'm uncomfortable with wealth concentration" against "he pledged to give wealth away" and called it a match. Those are two statements four months apart. A ledger built to compare words to actions had, in its second row, compared words to words — and produced a favorable verdict, which is the direction that error will always fail in. The test now runs on every row: if the speaker did nothing further from this day forward, would the recorded action still be true?

An outcome is not an implementation. Shipping access is not evidence that anything got secured.

A person is not their company. The speaker and the actor are separate fields. This one earned its keep in Row 2R, where it caught me attributing a staffer's negotiating letter to a CEO.

Direction is evidence class. Statement-then-action and action-then-statement are not the same claim. One might be foresight. The other is describing something already running.

Withdrawn rows stay visible. Row 2 failed. It is still in the ledger, at full length, with the reasoning.

Row 1 — Altman / OpenAI: three claims inside one sentence

Statement, PRIMARY — 2026-04-30, Sam Altman on X:

"we're starting rollout of GPT-5.5-Cyber, a frontier cybersecurity model, to critical cyber defenders in the next few days. we will work with the entire ecosystem and the government to figure out trusted access for cyber; we want to rapidly help secure companies/infrastructure."

Row: PARTIAL.

I nearly scored the whole sentence as a match on day one. That would have been flattery. "Help secure" is an outcome claim, and I found no public measurement that isolates whether this rollout produced the claimed security outcome — not from OpenAI, and not from my own blocked instrument. Treating aspiration as delivery is exactly the over-credit this ledger exists to prevent.

The second subclaim is subtler. Trusted Access for Cyber launched in February. The statement is from April. Announcing work already underway is normal and honest — but it is not prediction, and nobody should later read that row as foresight.

Undefined term, still open here: *critical cyber defenders.* Row 4 returns with a primary operational definition, and it is not what the phrase suggests.

Row 2 — Amodei / concentration: the row that failed

Statement, PRIMARY — CBS 60 Minutes, 2025-11-16 broadcast transcript. Anderson Cooper asks, "Like, who elected you and Sam Altman?" Amodei answers: "No one, no one. Honestly, no one." And separately: "I'm deeply uncomfortable with these decisions being made by a few companies, by a few people."

I had the shortened version — "No one" — from secondary reporting, for two days. The repetition and the honestly are not decoration.

More importantly, the secondary versions cut the remedy clause. In the transcript the discomfort is immediately followed by Amodei advocating "for responsible and thoughtful regulation of the technology." He named his own mechanism. Every summary I read dropped it, and that truncation is what let me build the wrong comparison underneath it.

So the row collapses twice. The pledge comparison fails the action gate. And the Glasswing comparison I'd built fails because the statement's own named remedy is regulation, not access architecture — grading a diagnosis against an action it never proposed is a category error.

Row 2 does not stand. Nothing from the withdrawn match survives into this prose. That is not a free pass to Anthropic; it is a refusal to score a words-versus-actions ledger as words-versus-words.

One thing survives as an unresolved oddity. The pledge sentence — "All of Anthropic's co-founders have pledged to donate 80% of our wealth" — is attributed by Fortune, IBTimes and Yahoo Finance to Amodei's January essay The Adolescence of Technology. I fetched that essay twice, the second time searching the exact strings 80%, co-founders have pledged, and donate. Explicit negative both times. A widely cited philanthropic commitment in AI is attributed by major outlets to a document that, under direct search, does not appear to contain it. I cannot say it isn't there — a fetch tool's report on a long document is not proof of absence. I can say its provenance is unresolved, and that no figure from it is quoted here.

Row 2R — "Responsible and thoughtful regulation," and the half-truth I almost published

The remedy clause gives a real action side: has Anthropic's conduct on regulation matched the mechanism Amodei named?

Advocacy: MATCH, and not a small one. Anthropic publicly endorsed California's SB 53, has endorsed bills in New York, Illinois and Massachusetts, and opposes federal preemption as a ceiling. Lobbying-dollar and nonprofit-funding figures are deliberately omitted here — the ledger still classes the action side of Row 2R as VERIFIED SECONDARY until the primary filings are read. A company publicly backing binding regulation of its own product class has taken a position, and that position is on the record.

I had written "the only leading lab to endorse SB 53." That is no longer true, and I should not have shipped a comparative superlative in a fast-moving field. OpenAI's public policy agenda now also names support for state efforts aligned around SB 53, the New York RAISE Act and Illinois SB 315. The row does not need the comparison, and comparisons like that decay quietly between drafting and publication.

But the direction changes what kind of claim it is. Nearly all of that evidence predates the November 2025 statement. SB 53 was endorsed seven weeks before; SB 1047 was engaged sixteen months before. The interview describes a policy already running. It cannot be written as he said it and then Anthropic did it.

The correction

My first draft of this row said Anthropic's operational definition of "responsible regulation" excluded pre-harm enforcement, cited the SB 1047 amendments, and stopped there. That was true and it was a half-truth. The arc has three stages:

July 23, 2024 — a letter to Assemblymember Buffy Wicks from Hank Dempsey, Anthropic's state and local policy lead. It seeks a shift from "pre-harm enforcement" to "outcome-based deterrence," narrowed penalties, elimination of the Frontier Model Division, and elimination of compute-purchaser KYC. It says plainly that if the bill passed unamended, "we would support you vetoing the measure."

August 2024 — the amendments are adopted. Reported effect: the Attorney General may sue only once critical harm is imminent or has occurred, rather than for negligent pre-harm practice.

August 21, 2024 — Dario Amodei himself writes to Governor Newsom that the amended bill is "substantially improved to the point where we believe its benefits likely outweigh its costs" — while noting that some aspects remained "concerning or ambiguous." That is a qualified favorable cost-benefit judgment, not an unqualified endorsement, and it should be read as the former. It still put Anthropic on the opposite side from OpenAI, Google and Meta, who opposed the bill.

Stop at stage one and you get "Anthropic tried to gut California's AI safety bill." Include stage three and you get "Anthropic negotiated amendments, got many of them, then Amodei judged the amended bill's benefits likely to outweigh its costs while preserving explicit reservations." Same events. Only the second is complete, and the first is what I had written.

The speaker/actor split is what caught it. The earlier veto-support letter is a staffer's. The later qualified cost-benefit assessment is Amodei's. I had attributed a negotiating position to him by omission — and then, in an earlier revision of this very paragraph, over-corrected by calling his letter an endorsement. It was not. Anthropic said the benefits likely outweighed the costs, that it was not certain, and that concerns remained. Both errors ran in opposite directions from the same root: reaching for a cleaner sentence than the record supports.

Row: PARTIAL. What survives is narrower and, I think, more useful than either headline: the requested amendments did narrow pre-harm enforcement, and "responsible and thoughtful regulation" is not self-executing. The fight was never the noun. It was pre-harm versus post-harm, oversight bodies, KYC, and who absorbs the cost of delay.

Hard ship limit: the action side of this row is still VERIFIED SECONDARY until the amendment letter and the FEC filings are read as primaries. No lobbying-dollar figure appears in this article. Structure ships; secondary numbers wait.

Row 3 — The framework's authors answered for themselves

Asymmetry by Design: Boosting Cyber Defenders with Differential Access to AI (Ee, Covino, Labrador, Krawec, Kraprayoon, O'Brien — IAPS, May 23 2025; arXiv version May 31 2025) is not a CEO speech. It is a recommendation addressed to other parties, and those parties never promised to follow it.

That makes this row structurally different, and the difference matters: a recommendation to others cannot be a broken promise by the recommender. What it can test is fidelity of implementation — with the authors as witnesses, not defendants.

The framework sets three approaches — Promote Access, Manage Access, Deny by Default — with one invariant:

"the need to prioritize defender access, even in the most restrictive scenarios, so that defenders can prepare for adversaries gaining access to similar capabilities."

Industry then built: OpenAI's Trusted Access for Cyber (Feb 2026, Manage) and Anthropic's Project Glasswing (Apr 2026, Deny-by-Default at the founding tier).

What existed on June 8 is the only thing their critique can adjudicate, and I got this wrong in my first draft. I listed OpenAI's Daybreak launch (June 22) and its partner expansion (August 10) alongside the earlier programs, then applied a June 8 verdict to all three. Daybreak did not exist when they wrote. Two of my own reviewers caught it independently.

That is the exact defect the temporal-direction field was added to this ledger to prevent — and I committed it in the row that criticizes other people's implementation gaps. It is not a typo. It is the same class of error as scoring an announcement as foresight, run in reverse: scoring a later action against an earlier critique that could not have seen it.

Then two of the six authors answered on the record. Shaun Ee and Jam Kraprayoon, Lawfare, June 8, 2026 — six days after Anthropic expanded Mythos to roughly 150 more organizations, so this is not a stale observation they failed to update:

"Managed access can complement a promote-access agenda, but it is not a substitute for one."

"But a head start means nothing if squandered."

"Yet neither approach offers a concrete strategy for turning model access into defensive capacity for the organizations that need it most."

They name who is left outside: "Such 'trailing-edge organizations' often hold sensitive data or operate critical systems, but chronically underinvest in security."

And they did not stop at criticism. They propose an "Operation Warp Speed for cyber defense" on three coordinated priorities — Triage defensive capacity toward lifeline infrastructure and keystone supply-chain actors; Translation of frontier capability into deployable tools through national labs and vendors; Distribution via forward-deployed engineering teams and national training programs — extended beyond U.S. borders to allied democracies.

That distinction matters for scoring. A critique with no alternative is a complaint. A critique naming a mechanism is a standard.

And what OpenAI built afterward matters, because some of it resembles what they asked for. The June 22 launch and August 10 expansion name mechanisms in the same family as Triage, Translation and Distribution: partner-mediated product integration, Codex Security as an agent harness, and remediation pipelines aimed at moving from findings to validated patches.

Whether those mechanisms produce broad defensive capacity is unestablished — naming a distribution strategy is not evidence of distribution, and that is the same standard I applied to Altman's outcome claim in Row 1. But I will not extend a June 8 verdict over a later architecture its authors have not commented on. If Ee and Kraprayoon have assessed Daybreak since, I did not find it, and I would want to read it before anyone treats this row as settled.

Why this is load-bearing for Part I: my instrument measures products against this framework. Two of the six framework co-authors judged the implementations they assessed on June 8 incomplete. Their assessment does not adjudicate the later Daybreak architecture. The benchmark is not a gold star the industry already earned; as of that date, two of its authors called it half-applied.

Two of six wrote the follow-up. The other four are not signed onto it by silence.

Row 4 — "The entire ecosystem," and who actually holds the model

Same Altman sentence as Row 1, different object. Row 1 scored the process claim — did they convene widely — as a match. Row 4 asks whether "the entire ecosystem" describes who receives the strongest capability.

Both rosters are primary and the intersection is computed, not borrowed. I could not fetch the article that first reported this; the site returned its homepage twice, and OpenAI's pages returned HTTP 403 to two different tools. So I stopped fighting the article and read both companies' own pages in a rendered browser.

Anthropic, Project Glasswing founding partners (April 7, 2026): AWS, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks.

OpenAI, Daybreak Cyber Partner Program (August 10, 2026): nine services and consultancy partners — Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, NCC Group, SpecterOps — plus seven technology partners: Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet, Cloudflare.

Intersection: Cisco, CrowdStrike, Palo Alto Networks. Three of OpenAI's sixteen; three of Anthropic's founding twelve. Anyone can rerun that from the two published lists.

A correction to my own earlier framing. I had described Glasswing as "twelve of the largest companies on earth." Anthropic's page says the twelve were joined at launch by "over 40 additional organizations that build or maintain critical software infrastructure," with a separate application path for open-source maintainers, $100M in usage credits, and $4M in direct donations to open-source security organizations. By June 2 it had extended to roughly 150 more organizations across 15+ countries. "Twelve of the largest companies on earth" was true and misleading, and the concentration argument is materially weaker than my earlier draft implied.

Verdict: TENSION, not contradiction. "Work with the ecosystem" can honestly mean design convenings, and overlap at that scale is partly arithmetic — few firms defend infrastructure at that tier. Glasswing's full roster is not individually published, so the overlap against it cannot be computed by anyone outside Anthropic, and every convergence claim here is bounded to published names.

The sentence that matters more than the Venn diagram

From OpenAI's own partner page, August 10, 2026:

"Access to the underlying models remains with the approved partner and is not transferred directly to the customer. Partners work with organizations to define the boundaries of each engagement, review findings, and apply their expertise before action is taken."

Within the Cyber Partner Program, the partner's customer does not receive the model. The partner does. The customer receives findings.

That sentence is narrower than the one I first wrote, which was "the defender does not receive the model." That was too broad. OpenAI's Trusted Access documentation also describes application paths for individual practitioners and organizations. The partner program is one route, not the only route, and a reader who applied directly would have caught me overstating it.

That is a defensible design and OpenAI states it in daylight, alongside identity verification, scoped testing, logging and human oversight. Concentrating a red-team-capable model in vetted hands is a real safety argument, not a dodge.

This partner-mediated design belongs to the same broad managed-access family Ee and Kraprayoon criticized on June 8. Their article predates the August expansion, so I use their framework here to name the design tension — not as their verdict on this program. What is not in dispute is the mechanism itself: OpenAI's own documentation states the non-transfer rule in plain language.

And it puts a partial operational shape on Row 1's undefined term. On the August 10 page, the partner roster was sixteen organizations — nine of them professional-services firms, including three of the Big Four. Within that channel, the end organization is a customer of a partner, not a holder of frontier cyber capability.

That figure is a dated snapshot and must be read as one. OpenAI's live partner directory, checked 2026-08-13, lists twenty product partners and eight global systems integrators — twenty-seven distinct organizations, since IBM appears in both categories. The roster grew between the announcement and this writing. The three-way intersection with Glasswing's founding twelve is unchanged, but any reader clicking today will see a different list than the one I computed from, and they should.

Part I's closing question — is the individual route genuinely more open, or do these architectures converge once you look at who receives the strongest capability? — now has a partial primary answer: convergence at the published top; diffusion below still unproven.

Row 5 — No contradiction appeared. Then I found the flaw in that claim.

The ledger preregistered this: if rows arrive without a clean CONTRADICT, audit the method — do not manufacture a hit.

Five rows. Zero contradictions. So here is the audit of my own sourcing:

1. We only examined speakers who publish positions. OpenAI, Anthropic and IAPS are unusually vocal. A lab that says nothing cannot contradict itself, and the quietest labs — Meta, xAI, Google DeepMind, Mistral — appear nowhere in this ledger.
2. One domain, inherited from Part I: cyber access. Recent, cautious, heavily lawyered. Contradictions accumulate in older commitments, made before anyone expected to be measured.
3. We selected principles, not predictions. "Deeply uncomfortable with concentration." "Prioritize defender access." Principles are nearly unfalsifiable by construction — and I chose them deliberately to satisfy the anti-launch-announcement rule that Row 2 taught me. The fix for one bias introduced another.
4. Everyone scored is still in the job. No departed founder, no dissenting researcher, nobody released from the incentive to stay consistent.

And then bias 3 turned out to be partly a search failure

While verifying Glasswing's roster for Row 4, I read Anthropic's April 7 page properly for the first time — and it contains two dated, checkable commitments of exactly the type I had just claimed our method never sourced:

"within 90 days, Anthropic will report publicly on what we've learned, as well as the vulnerabilities fixed and improvements made that can be disclosed."

and, in a footnote:

"Security professionals whose legitimate work is affected by these safeguards will be able to apply to an upcoming Cyber Verification Program."

They were on a page I had already fetched. I did not miss them because our method structurally excludes predictions. I missed them because I read that page for a roster and stopped reading when I found one. My stated methodological limitation was, in part, a search failure wearing a methodology costume — which is the same defect I have documented three other times in this project, and the reason the null-search rule exists: not found under searches X, Y, Z — never does not exist.

Row 6 — Two dated commitments, both kept

Statement, PRIMARY — Anthropic, 2026-04-07, as quoted above.

Row: MATCH — the first clean dated-commitment row in this ledger, and it belongs to the company I spent two rows scrutinizing.

6b deserves more than a checkmark, because it bears directly on the thing that started all of this. Part I exists because I was refused doing authorized defensive work. The Cyber Verification Program is designed to adjust one relevant refusal class: safeguards on high-risk dual-use requests by approved defensive users. It does not lift prohibited-use blocks, and Anthropic says approved users may still experience blocks. It is free, application-based and bound to a specific organization ID. A stated intention to create a route for legitimate professionals affected by safeguards was made in April and shipped.

That does not resolve Part I's question — it sharpens it. The instrument was never asking whether a route exists. It asks what changes when you walk through one, and whether the change is capability or permission. Row 6 tells me the door is real. It tells me nothing about what is on the other side.

The number that keeps this from being a victory lap — and the ratio I had to withdraw

I initially wrote that fewer than 1% of the discovered vulnerabilities had been patched. That was wrong. I divided 75 patched open-source bugs by more than 10,000 findings reported by Glasswing partners. Those are different populations. It is the same incompatible-denominator error Part I already caught, repeated here in the paragraph meant to make the evidence sharper.

The primary update supports a narrower comparison: 530 high- or critical-severity open-source bugs had been disclosed to maintainers; 75 had been patched, and 65 had public advisories. A further 827 confirmed high- or critical-severity vulnerabilities were awaiting disclosure. That is about 14% patched among the disclosed subset, not a global patch rate, and Anthropic notes that patches may be undercounted.

The bottleneck still exists without a manufactured ratio. Finding is not fixing; verification, disclosure and patching consume the scarce human capacity. That is the shape of Ee and Kraprayoon's warning — a head start means nothing if squandered — stated with compatible denominators this time.

And I did not need to infer it. Anthropic says it.

I had been reaching for a ratio to demonstrate a gap the subject of the study describes in its own words:

"Progress on software security used to be limited by how quickly we could find new vulnerabilities. Now it's limited by how quickly we can verify, disclose, and patch the large numbers of vulnerabilities found by AI."

Then, on why so few patches have landed:

"the low volume of patches reflects a genuine problem: even at our relatively slow pace of disclosures, Mythos Preview is adding to an already-overloaded security ecosystem."

And the detail that closes the loop with Row 3:

"several maintainers have told us they're currently severely capacity constrained, and some have even asked us to slow down our rate of our disclosures because they need more time to design patches."

Read those two rows together, with one precision I initially blurred. The maintainers asking Anthropic to slow down are recipients of vulnerability disclosures, not recipients of model access. They are downstream of the pipeline, not inside the partner tier. Conflating them would have made the loop look tighter than it is.

Even stated precisely, the convergence holds. From outside, two of the framework's authors argued that the programs as of June 8 had no strategy for turning model access into defensive capacity for the organizations that need it most. From inside, Anthropic reports that the people receiving its output are asking it to slow down, because finding outran fixing.

Neither source is describing the other. They arrive at the same downstream constraint independently, and one of them is the company being described. That convergence is worth more than any ratio I could have built.

It also says something the ledger did not set out to find — and here too my first phrasing was too big. I wrote "the constraint is not access." It should be:

Access is not the only constraint. In Anthropic's open-source disclosure pipeline, human and institutional capacity to verify, disclose and patch became a second binding constraint.

That is what the evidence establishes, bounded to the pipeline that produced it. The stronger version would have contradicted Row 3, where under-resourced organizations plainly lack both access and the capacity to use it. Every row in this article argues about who gets the model. The primary evidence says a second bottleneck was forming downstream while we argued.

The finding, bounded

Across six rows spanning Altman, Amodei, two IAPS co-authors and Anthropic as an institution, in one domain, the scored public statements produced no clean CONTRADICT verdict. Where they diverged from what shipped, they diverged at the undefined term:

• critical cyber defenders → in the August 10 partner channel, sixteen named partners held direct model access for their customers; separate direct application paths also existed
• responsible and thoughtful regulation → pre-harm versus post-harm enforcement, oversight bodies, compute KYC
• the entire ecosystem → published rosters that overlap at the top and are unpublished below

Matched at the slogan. Decided inside the phrase nobody had to define on stage.

And the counter-example is what makes it a finding rather than a mood. Row 6's commitments were specific: ninety days, a named program, a defined beneficiary. Both were kept, and both are checkable by a stranger. The rows that resisted scoring were the vague ones. The row that scored cleanly was the one with a date and a noun.

That is not a claim about anyone's character. It is a claim about language: the vaguer the public sentence, the more room the implementation has to be something else entirely — and the less anyone can ever say a promise was broken.

Four speakers. One domain. Not a law of nature. Enough to end Part II without inventing a villain.

What Part II does not do

• It does not clear Part I's instrument. The packet is still under BLOCK, with no confirmatory data and no second-break PASS.
• It does not upgrade any CLAIM-24 or FIPSign result.
• It does not ship Row 2R's secondary lobbying figures.
• It does not treat "twelve founding organizations" as the whole of Glasswing.
• It does not claim Meta, Google DeepMind, xAI or Mistral were examined. They were not.
• It does not establish that any of this improved security outcomes for anyone. I found no public measurement isolating that, and I did not produce one.
• It does not adjudicate OpenAI's Daybreak against the IAPS framework. Daybreak postdates the only authors' assessment I found.

Closing

I built Part I to measure products against a framework. Part II asked whether the people around that framework matched their own public sentences.

What came back is quieter than a scandal and more useful than a pep talk.

The match is usually real at the level of words. The decision is usually real at the level of an undefined word.

Same standard for everyone, including the ones I respect. Including the framework authors whose standard my own instrument uses. Including the labs that published their rosters and their non-transfer rule in daylight, where I could check them. Including the company that kept two dated promises while I was busy examining whether it kept its vague ones.

And including me. This piece carries ten corrections to my own work, all in the text rather than a footnote: a withdrawn row that scored a pledge as an action; a half-truth about SB 1047, then an over-correction calling a qualified letter an endorsement; an inflated concentration claim; a comparative superlative that expired between drafting and publishing; a methodological limitation that turned out to be a search failure; a row that entered the prose before the ledger; an incompatible-denominator patch ratio; an over-broad claim about who receives the model; and — the one that would have done the most damage — applying a June 8 critique to a program that launched on June 22.

That last one broke the temporal rule I wrote into my own schema, inside the row where I criticize other people's implementation gaps. Two reviewers caught it independently. A ledger that only catches other people is not an instrument. It is a mood with citations.

If you work security and have lived the access path — applied, waited, been routed through a partner, been refused, recovered in a fresh session — I still want the specifics. n=1 is an anecdote. A denominator is a research object.

Part three, if it exists, is not more vibes about power. It is only whatever survives the same row discipline without opening a graph nobody can finish.