Over time, there might be an increasingly large gap between insider model access and outsider model access. By insiders, I mean employees at the frontier lab.^[1] By "outsiders", I mean external safety researchers, third-party auditors, and other actors trying to make the future go well. I will call this a model access gap — and when the gap is small, I'll call this model access parity.^[2]

I think that one of the top priorities for the external AI safety community over the next 6-12 months should be ensuring model access parity. Main reasons:

This would allow us to direct billions of dollars in AI labour towards making things go well. This seems robustly good, regardless of what activities we decide to actually direct the labour towards.
I think publicly available models will probably lag 3-6 months behind the best internal models. Hence, as R&D uplift grows superexponentially, we might see the differential uplift grow from 2x to 60x. In short: I think achieving model access parity might be preferable to scaling the headcount of outsider orgs by ten-fold.
Model access parity isn't too far from the status quo, but it's the kind of thing that we could lose soon. I think precedent here might be sticky, so it seems like a good time to push for it.

To be clear: I think this is a big deal, it probably won't happen by default, and we are not on track to achieve it.

Which outsiders?

"Outsiders" includes the AI safety community outside the frontier labs, along with other actors trying to make the future go well. To make thing concrete, I've included a list below of orgs this might include.

I want to be clear that this list is intentionally expansive — it's not supposed to indicate which outsiders are top priority for model access parity. One might believe there are just 3-5 high-priority orgs, such that ensuring model access parity for these orgs would capture most of the value from a widespread model access parity. Alternatively, you might believe that the returns diminish slowly, and we should push for access for the entire list.

Examples of outsiders

People evaluating risk posed by current or imminent deployments (METR, Apollo, UK AISI, AI Lab Watch)
People tracking and forecasting capabilities (Epoch, METR, AIFP, etc)
Grantmakers (Coefficient Giving, FLF, OpenAI Foundation, Longview, Macroscopic, etc)
People building stuff like “AI for Epistemics” or "AI for coordination"
External groups developing techniques to be exported to the labs (Redwood, Truthful AI, Cooperative AI Foundation, FAR.ai, Geodesic, most MATS projects)
External researchers who want to do theoretical alignment research (Sequent/Timaeus/Simplex, ARC, Iliad/PIBBSS-y stuff, formerly-MIRI people, Guaranteed Safe AI)
External researchers working on ambitious mech interp.
People trying to do pursue non-ASI paths to good futures (brain uploads, adult intelligence enhancement)
Academic labs (Stephen Casper, Vincent Conitzer, etc)
Engineers who want to build tooling for the labs and others (Trancluce, Meridian Labs, training better classifiers for control)
External groups who want to make the future better, not via AI safety (Forethought, Acorn, ACS)
External groups trying to solve technical bottlenecks to slowdown (hardware verification, tracking covert datacentres)
d/acc things (cyber-defense, bio-defense, societal hardening, formally-verified code)
Maybe some government organisations (EUAIO, CAISI, UK AISI)

Who aren’t outsiders?

The public — Things would probably go better if the public had similar model access as the insiders. This would help with concentrations of power, wake up, and other risks described in Daniel Kokotajlo's Training AGI in Secret would be Unsafe and Unethical. But this article isn’t about that — it's just about model access for outsiders (which I think has different strategic properties).
Trailing labs — It might also be good if employees at trailing also had access to the best internal models at the leading. Maybe, I haven't thought much about it. But I'm ignoring them because: (i) there are a bunch of thorny issues here, which don't arise with third-parties, and (ii) the upside is lower because (presumably) the trailing lab have their own models.
Government — It might be good if the government had access to the best internal models. (Although, I'm a little worried if the government had much better access than the public.) In any case, this isn't my focus. Probably the government has a bunch of leverage over the labs which outsiders don't, so our interventions here would look pretty different.

What kinds of model access gap should we worry about?

Here are five mechanisms that could contribute to a model access gap. I've ordered them in decreasing order of how severe I expect them to be.

Non-release. The best internal models are either never deployed externally, or deployed only to partners I’m not focusing on (military, hardware suppliers, etc).
Deployment lag. Models are eventually released, but available internally first, where this lag is enough to substantially hinder outsiders.
Safeguards. Models are available, but wrapped in refusals and other policies that don't bind insiders.
Cost and rate limits. Models are prohibitively priced or rate-limited.
Elicitation techniques (e.g. finetuning). You can't train the model on your specific task domain.

I'll discuss these in more detail below.

Non-release

As of late June, the most powerful internal models are not available to the public at any price. And (to my knowledge) they aren't available to almsot any of the outsiders I listed above. This is probably the main development in the strategic landscape during Q2 2026.

I won't go through the timeline of the Mythos saga here (not least because it's still on-going), but the main takeaway is that the government will make it increasingly difficult for labs to release models, due to a combination of (i) competitiveness concerns, (ii) security concerns, (iii) preferential treatment of the labs.

My best guess is that Mythos-level models will be released to the public in the coming weeks. But I think it's plausible that this is the final generation of models which are widely deployed. And I think it's more likely than not that superhuman AI researchers are never widely deployed until the labs acheive ASI.

Deployment lag

Even if models are eventually released, they might be available internally several months earlier. Before the Mythos saga, these lags hadn't produced much of a model access gap: the gaps between the models is quite small, so it's not much hindrance to use the best available public model for a few weeks.

But deployment lags may be more worrying in the future:

My guess is that deployment lags will grow. This is mostly because the government will play a bigger role in the deployment decisions, and they a notoriously slow-moving entity. Also, the models will require more vetting and safeguards. There are some counterveiling effects (e.g. labs are more desperate for revenue/investment, they can accelerate their own pre-deployment evals, etc) but I expect these will be outweighed.
A fixed deployment lag is a bigger deal when AI progress is superexponential. Let Uplift(T) be the uplift from the best internal model at time T, and Uplift(T−δ) be uplift from the best model δ weeks earlier. Then if AI progresses superexponentially, then the ratio uplift(T)/uplift(T-delta) is increasing in T, i.e. the same wall-clock lag would imply a larger uplift multiplier.

Below, I've added some numbers from AI Futures model. Note that, I expect this table will overestimate the uplift gap, because outsiders will focus on domains with worse uplift than software R&D.

	Software R&D uplift	3 month lag	6 month
June 2028	2.8x (Automated Coder)	2x?	1.5x?
Feb 2029	84x (TED-AI)	9x	3.3x
May 2029	1700x (ASI)	84x	9x

Safeguards

As models get dangerous capabilities, labs will add more safeguards on model deployed publicly, e.g. refusal training, constitutional classifiers, etc. Especially if they are bound by RSPs, regulations, or reputational concerns. But the internal models will probably lack these safeguards. These safeguards might diminish the usefulness of the models.

It would be good if outsiders could make use of the best models without prohibitive safeguards. But historically, labs haven't been obliging about providing outsiders with access to non-public model access with diminished safeguards, e.g. helpful-only, deprecated models.

My best guess is that safeguards won't be a significant contributor to model access gap:

I think this isn't biting right now. I haven't seen external safety researchers complain that refusals are blocking their work.
The insiders might also be hindered by the safeguards, e.g. because the labs are worried about insider threats or misaligned AIs.
I’m optimistic that KYC will solve this if it becomes an issue, c.f. Access Controls Will Solve the Dual-Use Dilemma

That said, it's not implausible that safeguards become biting. And potentially, in 6-12 months, safeguards become one of the biggest bottlenecks on outsiders getting work done.

Costs and rate limits

Maybe a model is technically available to the public, but outsiders can't run it at the workload insiders do, because they are constrained by costs or rate limits. This would contribute to a model access gap.

We should expect the market-rate of frontier models to rise: AIs will use up more GPUs, because of training-time scaling and inference-time scaling; and the opportunity cost for GPUs will increase.^[4] See You are going to get priced out of the best AI coding tools (Daniel Paleka, 5th Nov 2025).

However, I think if labs provided the best internal models to outsiders with no markup, then I'm optimistic about the outsiders covering the rising costs. The outsiders will probably be able to spend billions of dollars during the ASI transition on making things go well. This is probably doable simply with philanthropic funding (supposing it's invested well). In particualr, if philanthropists expect to be spending most of their funding on compute, then they could invest in compute (and assets correlated with compute) as a hedge. If funders can’t cover the rising API costs, then we would need to lobby the labs or governments to subsidise compute, but this lobbying seems much more persuasive if we have the API access so we can demonstrate that the marginal utility of AI labour looks good.

Elicitation techniques (e.g. finetuning)

Lab employees probably have access to elicitation techniques like finetuning, RL training, scaffolding, etc. They'll use this to improve the models on the internal tasks, e.g. coding, architecture design, cybersecurity, etc. But if outsiders don't have access to the same elicitation techniques, then they may end up using a model that is less elicited for their use case.

I don't expect this to bite hard in practice. The internal models are presumably well-elicited for internal tasks, and I expect enough generalisation between the distribution of internal tasks and external tasks. So an external researcher with access to the internal model probably doesn’t get a big uplift boost from elicitation access.

It's possible outsiders want to do different kinds of work than the insiders (e.g. policy stuff, conceptual research, macrostrategy, hard-to-verify reasoning). Hence, the outsiders will enjoy less uplift than the insiders. But I don't expect that this capability limitation could be resolved simply by giving outsiders access to the same elicitation techniques as insiders. If this does occur, then I recommend outsiders simply construct benchmarks/evals/RL-tasks which they want labs to hill-climb.