The Model Wars Are Over. The Clearance Wars Begin.

OpenAI previewed GPT-5.6 and, in doing so, became the first lab to ship a model the US government clears for use customer by customer. Read that as an engineering release and you miss everything. The model is not the story. The gate is. For the first time, a frontier capability arrived not when it was built, but when it was permitted — and the permission is granted one customer at a time.

What actually shipped

The release has three tiers. Sol is the flagship. Terra sits in the same class as GPT-5.5 at roughly half the cost. Luna is the cheapest, built for volume. There is a new ultra mode that spins up subagents to attack harder problems in parallel. On the surface, this is a clean, well-segmented product line — the kind of tiering that signals a mature lab that understands its cost curve.

But every one of those capabilities shipped behind a limited preview only. And before release, OpenAI shared the model's capabilities with the US government. That sequencing is the whole point. The product decisions are downstream of a clearance decision that happened first.

Why the gate exists: cyber

The reason for the gate is not vague safety hand-waving. It is cyber, and the numbers are specific. On ExploitBench, Sol matches Anthropic's Mythos while using roughly one-third of the output tokens. It finds bugs and exploitation primitives in Chromium and Firefox — real browsers that billions of people run — stopping short of a full autonomous exploit, but not by a comfortable margin.

OpenAI spent 700,000 A100-equivalent GPU hours red-teaming its own safeguards before release. That is not a rounding error in a training budget; that is a deliberate, industrial-scale effort to understand what the model can do before anyone outside gets to ask it. And Sol runs on Cerebras at 750 tokens per second starting in July, which means whatever it can do, it can do fast and at scale.

Put those facts together and the gate is not paranoia. A model that finds exploitation primitives in the world's most-used browsers, at a third of the token cost of the prior frontier, running at 750 tokens per second, is a genuinely dual-use artifact. The lab knew it. The government knew it. The preview gate is the compromise that let it ship at all.

The quiet part, said out loud

OpenAI said the part most labs would keep internal: it does not want government approval to become the long-term default. That is a remarkable admission. It means the company shipping the model understands that the clearance regime it just participated in is a threshold being crossed, not a one-off accommodation. They cleared this launch and simultaneously warned against the precedent of clearing launches.

Capability used to ship the day it was ready. Now it ships when it's cleared. The bottleneck moved from compute to permission.

I have watched this exact pattern before, and it is worth being precise about the analogy, because the analogy is the argument.

We have run this playbook three times now

Strong encryption was classified as a munition. For years, exporting cryptographic software above a certain key length was legally equivalent to exporting weapons. The capability existed; shipping it required clearance. GPS shipped with selective availability — the civilian signal was deliberately degraded, its full precision reserved and released only when the government decided the strategic calculus had changed. Now inference joins that list.

The through-line is consistent. When a technology becomes strategically decisive, the state stops treating it as a product and starts treating it as a controlled capability. The pattern has three stages:

• Classification — the capability is recognized as dual-use and reframed as a matter of national security rather than commerce.
• Gating — release is made conditional on clearance, whether by export license, degraded signal, or customer-by-customer approval.
• Selective release — the full capability flows only to approved parties, on the government's timeline, not the builder's.

Encryption followed it. GPS followed it. GPT-5.6 is the first frontier model to follow it explicitly, with the government briefed before launch and access granted per customer. That is not a coincidence of one release. It is a category shift.

The bottleneck moved

For three years the constraint on AI progress was compute. Whoever had the most GPUs, the best data, and the best training runs shipped the best model, and they shipped it the moment it cleared their own evals. That world is closing. The new constraint is permission. You can have the compute, the data, the trained weights sitting on disk — and still not be allowed to ship, or only allowed to ship to a vetted list, on a schedule set outside your building.

This is why the strategic questions have changed. It is no longer only "who has the best model?" It is "who is allowed to run it, where, and for whom?" That reframing is the same one I trace in what Washington actually regulated — the muzzle, not the model: the control point moved from the artifact to its use. And it is why the architectural imperative I describe in who owns your harness matters more every quarter. If the model under your product can be gated by a government, the layer you own becomes the only thing you can count on.

The model wars are over. The clearance wars just started. I track that shift and what it means for anyone building on top of frontier models across my essays on AI policy and execution. Plan your architecture for a world where the smartest model available to you is the one you are cleared to run.