OpenAI Group PBC today announced the launch of GPT-5.4-Cyber, a fine-tuned variant of its GPT-5.4 model designed for defensive cybersecurity work and also announced a significant expansion of its Trusted Access for Cyber program to thousands of verified security professionals.

The new model has been purpose-built to lower refusal boundaries for legitimate cybersecurity tasks, or in the words of OpenAI, is “cyber-permissive” and adds capabilities not available in the standard version of GPT-5.4. Among the new capabilities is binary reverse engineering, a feature that allows security professionals to analyze compiled software for malware, vulnerabilities and security weaknesses without needing access to source code.

Given its permissive nature, OpenAI is limiting initial access to vetted security vendors, organizations and researchers. Access runs through the company’s Trusted Access for Cyber program, which OpenAI launched in February alongside a $10 million cybersecurity grant program. The program now adds tiered verification levels, with the highest tier unlocking GPT-5.4-Cyber.

Individual users can verify their identity at chatgpt.com/cyber and enterprises can request access through their OpenAI representative. Customers already enrolled in the program can apply for higher tiers separately.

OpenAI is pitching the release as preparation for more capable models expected later this year, saying that it’s “fine-tuning our models specifically to enable defensive cybersecurity use cases, starting today with a variant of GPT-5.4 trained to be cyber-permissive.”

The company added that it expects versions of its current safeguards to be sufficient for upcoming, more powerful models, while more permissive, cyber-specific variants will require stricter deployment controls.

OpenAI also cited progress from its Codex Security product, which launched in private beta six months ago and as a research preview earlier this year. OpenAI said Codex Security has contributed to fixes for more than 3,000 critical and high-severity vulnerabilities across the ecosystem since its recent broader launch.

The release comes one week after Anthropic PBC introduced Mythos, a new AI model that demonstrated strong cybersecurity capabilities, to a limited group of roughly 40 organizations. OpenAI’s rollout is broader, with the company targeting thousands of individual defenders and hundreds of security teams.

OpenAI also noted in its announcement that capture-the-flag benchmark performance across its models improved from 27% on GPT-5 in August 2025 to 76% on GPT-5.1-Codex-Max in November 2025 and said it is planning and evaluating future releases “as though each new model could reach ‘High’ levels of cybersecurity capability” under its Preparedness Framework.

The announcement comes amid a broader push that reflects a shift in how AI developers are approaching cybersecurity risk, moving away from blanket capability restrictions toward identity-based access controls. OpenAI said its goal is to make advanced defensive tools “as widely available as possible while preventing misuse” through automated verification systems rather than manual gatekeeping decisions.

The Trusted Access for Cyber program is also part of a wider ecosystem investment. It includes contributions to open-source security initiatives and free security scanning for open-source projects through Codex for Open Source, which OpenAI said has reached more than 1,000 projects to date.

Image: SiliconANGLE/Pixa