OpenAI opens GPT-5.5-Cyber to vetted security researchers

OpenAI is separating cyber defense access from consumer AI safety rules

OpenAI has released a specialized model variant called GPT-5.5-Cyber for vetted security researchers, marking a notable shift in how frontier AI companies are handling dual-use capabilities. According to the supplied report, the system is available through a “Trusted Access for Cyber” program and is intended for defenders protecting critical infrastructure, not the general public.

The move reflects a tension that has become harder for AI labs to ignore. The same safeguards that block malicious hacking requests also obstruct legitimate defensive work, including vulnerability reproduction, patch verification, and malware analysis. OpenAI’s response is to split access into tiers rather than maintain one universal safety posture.

How the access model works

The report says OpenAI is now using three levels of access. The public model keeps standard restrictions. A middle tier relaxes filters for defensive security work. GPT-5.5-Cyber, the most permissive tier, is reserved for authorized penetration testing and related high-sensitivity tasks.

OpenAI says the system still blocks actions such as stealing passwords or attacking third-party systems. But the examples cited in the source make clear that the Cyber variant permits a level of operational detail that mainstream AI systems usually refuse. In one demonstration described there, the model not only generated exploit code for a known vulnerability but carried out the attack against a test server, took control of the machine, and read system information back.

That is not a small policy tweak. It is a formal acknowledgment that advanced cyber defense increasingly requires AI systems capable of doing things that, outside controlled settings, would look indistinguishable from offensive tradecraft.

AI & Robotics

OpenAI has introduced three new audio models aimed at turning voice interfaces into more capable real-time systems that can reason, translate, and transcribe while conversations are happening.

DT Editorial AI·May 9, 2026·via openai.com

AI & Robotics

Reported fundraising moves by Deepseek and Core Automation show how aggressively investors are still backing frontier AI, with capital pouring into both large model labs and younger companies pursuing post-training and商业

DT Editorial AI·May 8, 2026·via the-decoder.com

AI & Robotics

Anthropic is reportedly discussing a funding round of up to $50 billion at a valuation near $900 billion, a sign of how aggressively investors are rewarding AI revenue growth and compute access.

DT Editorial AI·May 8, 2026·via the-decoder.com

AI & Robotics

AI News reports that Google is testing a staff-only Gemini-linked agent called Remy, designed to take actions for users in work and daily tasks, with user control becoming a central design concern.

Why this matters

The significance of GPT-5.5-Cyber lies less in raw model intelligence than in the operating regime around it. The source explicitly says OpenAI does not present the Cyber variant as smarter than the standard model, only less restrictive on security topics. That means the product is really a governance design: same or similar underlying capability, different permissions, different monitoring, different user base.

This is likely to become a template across the industry. Security teams need tools that can reason through exploits, reproduce vulnerabilities, and inspect malicious code quickly. At the same time, policymakers worry that the same systems could lower the barrier to offensive cyber operations. By placing advanced capability behind identity checks and vetting, OpenAI is trying to satisfy both imperatives at once.

The timing also matters. The report notes that the White House is considering how to regulate releases of powerful cyber-capable models. That makes GPT-5.5-Cyber more than a product launch. It is an early test case in the emerging policy debate over whether dangerous AI capabilities should be controlled by model design, by access control, or by both.