AI companies are holding back models that could be used in cyber attacks, instead deploying them to build defence systems.