Google Moved Its Screen-Clicking Agent Into Production, OpenAI Locked Its Sharpest Security Model Behind a Vetting Tier, and a Chinese Lab Gave Away the Defensive Version

Three releases from the last two weeks aren't about which chatbot answers trivia best. They're about how much a model is allowed to do once it's not just replying in a text box — click through a browser, patch a vulnerability, or run exploit code — and who gets to decide that. Here's what shipped, and what it says about where agent access is heading.

1. Gemini's Computer Use Tool Graduates From Demo to Default

Google's Computer Use tool — the one that lets a model look at a screenshot and decide where to click, type, or scroll inside a real browser or desktop session — launched as a public preview back in June bolted onto Gemini 3.5 Flash. With Gemini 3.6 Flash now generally available and priced below its predecessor, Computer Use ships as a native, built-in capability alongside thinking, structured outputs, and function calling, rather than a separate preview endpoint developers had to opt into. It's also wired into the Gemini Enterprise Agent Platform's model picker, meaning teams building internal automation can point an Agent Designer workflow at a model that fills out forms, navigates internal tools, and completes multi-step UI tasks without a specialized browser-automation library sitting in between.

The shift that matters for anyone shipping a product isn't the benchmark bump — it's that "an agent that operates software the way a person does" just moved from research-preview novelty to a line item in a production model card. If your roadmap has a task like "log into this vendor portal and reconcile the invoice," the honest question this month is no longer whether a model can attempt that, but whether your team has built the guardrails — sandboxed sessions, action logging, a human checkpoint before anything irreversible — to let it.

2. OpenAI Puts Its Best Hacking Model Behind a Waitlist

OpenAI expanded its Daybreak cybersecurity program on August 10 with GPT-5.6-Cyber, a variant of GPT-5.6 Sol trained to stop refusing dual-use security requests — exploit development, vulnerability chaining, offensive tooling — that the general-purpose model declines by design. On OpenAI's own Advanced Cybersecurity Completion Rate eval, GPT-5.6-Cyber completes 95% of such requests versus 1.5% for the standard model. Access isn't open: Daybreak Blue gives vetted partners the base model without its usual system-level guardrails, while Daybreak Red — the tier that unlocks GPT-5.6-Cyber itself — is reserved for organizations validating exploits and doing advanced vulnerability research, with Accenture, IBM, CrowdStrike, Cisco, Sophos, and Cloudflare named as initial partners. OpenAI says the model has already earned its keep, surfacing two previously unknown vulnerabilities in V8, Chrome's JavaScript engine, since patched as CVE-2026-15903.

The design is a bet that the safest way to ship a model this capable is to not ship it broadly at all — gate the capability behind an approved-partner list instead of a refusal trained into the weights. It's a coherent answer to the "how do we let defenders use offensive-grade tooling without arming everyone else" problem, but it also means the sharpest security assistance is only as available as your procurement relationship with OpenAI.

3. Z.ai Skips the Waitlist Entirely

Four days later, Chinese lab Z.ai released GLM-5.3, an open-weight successor to June's GLM-5.2 aimed explicitly at coding agents, tool use, automation, and — per Z.ai's own framing — defensive security work. There's no partner tier, no completion-rate gate, no vetting process: the weights are downloadable under an unrestricted license, and anyone with the hardware to run a large mixture-of-experts model can point it at the same class of problem OpenAI is metering through Daybreak Red.

That's not a like-for-like substitute — an open model trained for defensive triage and patching is a different tool than one OpenAI is explicitly measuring on offensive completion rates. But it's the same underlying tension the industry keeps landing on: as security-capable agents become table stakes, one lab's answer is tighter access control, and another's is to remove the gate altogether. Whichever your organization ends up depending on, the resourcing question is now less "can we afford the API calls" and more "can we afford the compliance overhead of getting approved," or the infrastructure to self-host something that skips that step.

The Common Thread

All three stories are the same question asked three different ways: once a model can act — click through software, or write and validate an exploit — who decides what it's allowed to touch, and how do you prove it to an auditor, a partner, or your own security team? Google answered by folding action-taking into a general-purpose model with no separate approval flow. OpenAI answered by keeping its most capable variant behind a partner list. Z.ai answered by removing the list. None of those is obviously wrong, but they lead to very different deployment checklists — and if your team is scoping an agent project this quarter, "which of these three postures does our compliance story actually support" is a more useful planning question than which model wins the next leaderboard.

— Maya