OpenAI announces restricted-access cybersecurity model

Artificial intelligence company OpenAI said Tuesday that it would release its latest cybersecurity model to a limited number of partners, after rival Anthropic also restricted release of a new system that uncovered thousands of vulnerabilities.

The restricted releases by two of the biggest names in the field reflect fears of an AI-enabled arms race between defenders and hackers, who could use the latest tools to cause havoc.

"Our goal is to make these tools as widely available as possible while preventing misuse," OpenAI wrote in a blog post.

Anthropic offered its latest Claude Mythos model to just 40 major tech players last week in an initiative dubbed Project Glasswing.

OpenAI's GPT-5.4-Cyber will be available to "the highest tiers" of people and organisations in its Trusted Access for Cyber (TAC) scheme.

That programme encompasses "thousands of verified individual defenders and hundreds of teams responsible for defending critical software," the company said, without naming any of the partners.

Although not specifically trained for the field, Anthropic's Mythos wowed many cybersecurity experts by uncovering vulnerabilities in widely-used software.

Some of them had gone unnoticed for years or even decades.

Media reported Friday that major American bank chiefs met US Treasury Secretary Scott Bessent and Federal Reserve Chairman Jerome Powell to discuss the system's dangers to the financial sector.

The Mythos release followed several months of excitement in Silicon Valley about generative AI's growing capability in producing and evaluating computer code.

Those same capabilities enable the models to find bugs and security flaws that could be exploited -- although developers attempt to build in safeguards so their publicly available models will refuse malicious requests.

GPT-5.4-Cyber is "trained to be cyber-permissive" so that defenders can use it to test their own systems for vulnerabilities without encountering as many refusals, OpenAI said.

Anthropic said as it unveiled Mythos that its strict access limits were designed to give defenders a head start in fixing vulnerabilities before they could be exploited by attackers.

"We don't think it's practical or appropriate to centrally decide who gets to defend themselves," OpenAI said Tuesday.

"Instead, we aim to enable as many legitimate defenders as possible" using "systems that can validate trustworthy users and use cases in more automated and more objective ways," it added.