OpenAI's gated cyber model

OpenAI has started offering a cyber-focused version of GPT-5.4 only to vetted security defenders and researchers, not to the general public. (openai.com) The program, called Trusted Access for Cyber, was introduced on February 5, 2026, and OpenAI said on April 14 that it is expanding from a pilot to “thousands” of verified individual defenders and “hundreds” of teams that protect critical software. (openai.com ) (openai.com) OpenAI said the new model, GPT-5.4-Cyber, is fine-tuned for defensive work such as reverse engineering, vulnerability analysis and malware analysis, and access is being routed through identity and trust checks rather than a normal public launch. (openai.com 1) (openai.com 2) Cybersecurity here means finding and fixing software weaknesses before attackers use them. OpenAI’s application form lists uses including penetration testing, red teaming, vulnerability assessment, malware reverse engineering, cryptographic research and threat intelligence investigations. (openai.com) The company has been moving in this direction for months as its general models got better at cyber tasks. In a system card published March 5, OpenAI said GPT-5.4 Thinking was its first general-purpose model with mitigations for “High capability in Cybersecurity.” (openai.com) That helps explain why OpenAI is tightening access instead of widening it. In December 2025, the company said stronger cyber capabilities can help defenders but also create “dual-use risks” that have to be managed carefully. (openai.com) OpenAI says it is pairing restricted access with technical controls. Its developer documentation says automated monitors look for suspicious cyber activity and can route high-risk traffic to a less cyber-capable model, GPT-5.2. (developers.openai.com) The access program also comes with money and screening. When OpenAI launched Trusted Access for Cyber in February, it said it was committing $10 million in application programming interface credits to accelerate cyber defense, and the intake form asks applicants about certifications such as CREST, International Organization for Standardization 27001, System and Organization Controls 2, Payment Card Industry Data Security Standard and Federal Risk and Authorization Management Program. (openai.com 1) (openai.com 2) GPT-5.4 itself was released on March 5 for ChatGPT, the application programming interface and Codex, with a 1 million-token context window and stronger coding and computer-use features. GPT-5.4-Cyber takes that base and puts the most sensitive cyber workflows behind a gate. (openai.com) (developers.openai.com) (openai.com)