A week after Anthropic unveiled Project Glasswing, OpenAI has introduced GPT-5.4-Cyber, a variant of its GPT-5.4 model built specifically for defensive cybersecurity work. Access isn’t open to everyone. You need to reach the upper tiers of OpenAI’s Trusted Access for Cyber (TAC) program, which launched in February alongside a ten-million-dollar fund for cybersecurity initiatives.<\/p>\n\n\n\n
The key difference: the model has a lower refusal threshold than standard versions. Normally, requests about analyzing vulnerabilities, understanding malware behavior, or researching exploits get blocked even when security professionals ask. GPT-5.4-Cyber is calibrated to handle these requests, provided the user has cleared TAC’s verification checks.<\/p>\n\n\n\n
There’s also a new capability for analyzing compiled binary code. This lets researchers examine applications and software for vulnerabilities or malicious behavior without needing the source code. OpenAI frames this as a stepping stone toward even more capable systems expected later in the year.<\/p>\n\n\n\n
There’s a catch worth noting. According to The Next Web, accessing the highest TAC tier, which unlocks GPT-5.4-Cyber, means giving up Zero Data Retention. OpenAI keeps session logs, which gives the company visibility into which vulnerabilities get analyzed, which systems get probed, and which exploits get discussed. For teams working on critical or classified infrastructure, this trade-off might conflict with operational security requirements.<\/p>\n\n\n\n
OpenAI is explicitly positioning itself as the more accessible option. Anthropic took a more restrictive approach with Project Glasswing, limiting Claude Mythos access to a small handful of large organizations. OpenAI’s pitch centers on broader distribution as a collective defense argument. CyberScoop reports the company says it wants to avoid arbitrarily deciding who gets access for legitimate uses, relying instead on identity verification as the gating mechanism.<\/p>\n\n\n\n
How sustainable this relative openness remains is an open question. US and British security experts have already flagged Claude Mythos as having significant offensive potential, which partly explains Anthropic’s decision to restrict access. GPT-5.4-Cyber follows a similar path, with a wider audience but still gatekept.<\/p>\n\n\n\n \n