OpenAI has unveiled a new cybersecurity-focused AI model and outlined a broader strategy for deploying advanced systems in defensive contexts, hot on the heels of Anthropic’s limited release of Mythos, a cybersecurity-focused AI model capable of identifying critical software vulnerabilities.

OpenAI announced the rollout of GPT-5.4-Cyber, a model specifically designed to identify and address software vulnerabilities.

While Anthropic’s Mythos announcement was accompanied by the formation of an industry coalition focused on the cybersecurity implications of genAI, OpenAI struck a more measured tone, emphasising its existing safeguards while acknowledging the need for more robust protections over time.

“We believe the class of safeguards in use today sufficiently reduce cyber risk enough to support broad deployment of current models,” OpenAI said in a blog post.

“We expect versions of these safeguards to be sufficient for upcoming more powerful models, while models explicitly trained and made more permissive for cybersecurity work require more restrictive deployments and appropriate controls. Over the long term, to ensure the ongoing sufficiency of AI safety in cybersecurity, we also expect the need for more expansive defenses for future models, whose capabilities will rapidly exceed even the best purpose-built models of today.”

Controlled access and “cyber-permissive” design

GPT-5.4-Cyber has been fine-tuned to support defensive cybersecurity use cases and is being made available to a select group of users through OpenAI’s Trusted Access for Cyber (TAC) programme, launched in February. The initiative allows verified cybersecurity professionals to test advanced models with fewer constraints when probing vulnerabilities.

“We are fine-tuning our models specifically to enable defensive cybersecurity use cases, starting today with a variant of GPT-5.4 trained to be cyber-permissive: GPT-5.4-Cyber,” the company stated.

The model is designed with a “lower refusal boundary”, meaning it is less likely to block sensitive security-related queries that general-purpose models might flag as risky. Among its capabilities is binary reverse engineering, enabling defenders to analyse compiled software for malware and vulnerabilities without access to the original source code.

Access to the model is restricted to vetted users, including security vendors, organisations, and researchers operating at the highest tiers of the TAC scheme. In some cases, participants may be required to waive “Zero-Data Retention” protections, allowing OpenAI greater visibility into how the model is used – particularly when accessed via third-party platforms.

OpenAI said it plans to expand the programme from hundreds of initial testers to thousands of verified defenders in the coming weeks, aiming to balance broader access with strict identity verification. The company framed this approach as part of a wider commitment to “democratized access”, seeking to avoid arbitrarily restricting legitimate users while maintaining safeguards against misuse.

Recommended reading

• OpenAI Backtracks on “Opportunistic and Sloppy” US Government Deal
• OpenAI Pauses Plans for Stargate UK
• OpenAI Targets 8,000 Staff in Enterprise AI Push
• OpenAI Survey Reveals Regional Divide in UK AI Uptake

The launch forms part of a broader cybersecurity strategy built around three core pillars. The first centres on “know your customer” validation systems to enable controlled but wide access to advanced models. The second involves “iterative deployment”, whereby capabilities are released gradually and refined based on real-world feedback, with a focus on resilience to jailbreaks and adversarial attacks. The third pillar emphasises continued investment in software security and digital defence as generative AI adoption accelerates.

OpenAI also positioned the initiative within its wider security efforts, including the recent launch of an application security AI agent known as Codex Security, a cybersecurity grants programme established in 2023, a donation to the Linux Foundation to support open source security, and its Preparedness Framework for assessing and mitigating “severe harm from frontier AI capabilities”. Under this framework, GPT-5.4 is classified as a “high” cyber capability model.

The company acknowledged that threats to digital infrastructure predate advanced AI but warned that malicious actors are increasingly experimenting with new AI-driven techniques. “Digital infrastructure has already been vulnerable for years, before advanced AI even came along,” OpenAI noted, adding that “threat actors are experimenting with novel AI-driven approaches.”