OpenAI Scales Trusted Access for Cyber Defenders with GPT-5.4-Cyber

OpenAI is significantly expanding its cybersecurity defenses with a major evolution of its Trusted Access for Cyber (TAC) program and the introduction of GPT-5.4-Cyber, a specialized model fine-tuned specifically for defensive cybersecurity use cases.

Scaling Trusted Access for Cyber Defenders

The company is scaling TAC to thousands of verified individual defenders and hundreds of teams responsible for protecting critical software infrastructure. This expansion builds on years of investment in cybersecurity research, grants, and defensive tools like Codex Security.

TAC operates on three core principles:

• Democratized access: Using objective criteria like strong KYC and identity verification to determine access levels
• Iterative deployment: Carefully releasing systems and improving them based on real-world usage and risk assessment
• Ecosystem resilience: Supporting defenders through grants, open-source contributions, and tools like Codex Security

GPT-5.4-Cyber: A Model Built for Defense

GPT-5.4-Cyber represents a significant step forward in defensive cybersecurity capabilities. This variant of GPT-5.4 is specifically trained to be "cyber-permissive," meaning it has lower refusal boundaries for legitimate cybersecurity work while maintaining appropriate safeguards.

The model enables advanced defensive workflows including binary reverse engineering capabilities, allowing security professionals to analyze compiled software for malware potential, vulnerabilities, and security robustness without needing access to source code.

Access Tiers and Verification

Access to GPT-5.4-Cyber is controlled through a tiered system:

• Individual users can verify their identity at chatgpt.com/cyber
• Enterprises can request trusted access through their OpenAI representative
• Higher tiers require additional authentication as legitimate cyber defenders

All approved users gain access to versions of existing models with reduced friction around safeguards that might trigger on dual-use cyber activity, enabling support for security education, defensive programming, and responsible vulnerability research.

The Cybersecurity Landscape and AI's Role

OpenAI's approach is grounded in the recognition that cyber risk is already accelerating. Digital infrastructure has been vulnerable for years, and existing models can already help find vulnerabilities, reason across codebases, and support meaningful parts of the cyber workflow.

Threat actors are actively experimenting with AI-driven approaches, making it essential to scale defenses alongside model capabilities. The company emphasizes that safeguards cannot wait for a single future threshold—they must evolve continuously as capabilities advance.

Codex Security and Ecosystem Support

Codex Security, launched in private beta six months ago and as a research preview earlier this year, has already contributed to over 3,000 critical and high fixed vulnerabilities across the ecosystem. The system automatically monitors codebases, validates issues, and proposes fixes, with precision and usefulness improving as models advance.

Long-term Vision for AI Safety in Cybersecurity

OpenAI acknowledges that as model capabilities rapidly exceed even today's best purpose-built models, more expansive defenses will be needed. The company expects that versions of current safeguards will be sufficient for upcoming more powerful models, while explicitly trained and more permissive models for cybersecurity work will require more restrictive deployments and appropriate controls.

This approach represents a careful balance between enabling defenders to protect critical infrastructure and preventing misuse, with access grounded in verification, trust signals, and accountability rather than centralized decision-making about who gets to defend themselves.

The expansion of TAC and introduction of GPT-5.4-Cyber signals OpenAI's commitment to scaling defensive cybersecurity capabilities in lockstep with advancing AI technology, ensuring that defenders have the tools they need to protect the digital infrastructure we all rely on.