Summary: On April 30, 2026, Sam Altman said GPT-5.5-Cyber would begin reaching users within days, with delivery limited to critical cyber defenders through Trusted Access for Cyber. The model’s penetration testing, exploitation, and malware reverse-engineering abilities are useful to defenders but also dual-use, which is why open release is excluded. The decision came nine days after Altman called Anthropic’s Mythos restrictions fear-based marketing, making the access reversal notable.
GPT-5.5-Cyber is on its way. In an X post on Thursday, April 30, 2026, Sam Altman confirmed the model would begin reaching users within days, with delivery limited “to critical cyber defenders.” Penetration testing, vulnerability identification and exploitation, and malware reverse engineering all sit in its skill set — and that skill set is precisely what disqualifies it from an open release.
Read the calendar and the irony writes itself. Back on April 21, Altman had publicly taken Anthropic to task for “gatekeeping” its cybersecurity model Mythos, dismissing the policy as “fear-based marketing.” Nine days on, OpenAI arrived at a nearly identical verdict for its own Cyber line. As for whether cyber-capable models belong behind a gate, the frontier labs have now settled the question — with deeds rather than debate.
Inside GPT-5.5-Cyber’s Capabilities
By OpenAI’s own framing, the Cyber line is a defense-oriented toolbox — one that helps companies surface security holes and stress-test their own protections. GPT-5.4-Cyber is already on the market, and GPT-5.5-Cyber succeeds it as the newer generation. Every entry on its ability list — penetration testing, vulnerability exploitation, malware reverse engineering — cuts both ways: the same edge that lets defenders harden systems shows attackers where the way in is. Restricted access, then, rests on what the capability is, not on any launch-week talking point.
Getting In: The Trusted Access for Cyber Process
The only door in is the Trusted Access for Cyber (TAC) program. Candidates complete a form on OpenAI’s website, supplying their credentials and what they intend to do with the model — the form probes both identity and purpose. Clear the review and you receive the newest model with less “friction” from safeguards — in practice, vetted defenders hold a version with fewer restrictions and better usability. Through the same channel, teams that can show legitimate defensive use may also request “dedicated more cyber-permissive models.”
Speaking to TechCrunch, an OpenAI spokesperson said TAC had grown “to thousands of verified defenders and hundreds of teams responsible for protecting critical software,” adding that the company is partnering with the U.S. government to widen access gradually.
Nine Days Earlier: The “Fear-Based Marketing” Jab
The irony at the heart of this story lives in its chronology. From April 9 onward, critics contended that Anthropic’s safety narrative around Mythos was inflated; by April 21, Altman had condensed that critique into “fear-based marketing.” Meanwhile, reports circulated that an unauthorized group had obtained access to Mythos regardless — proof that where a gap exists, no fence holds back a determined seeker.
By reversing course nine days later, OpenAI effectively endorsed its rival’s premise: once a cyber model’s offensive capability passes a certain line, open release costs more than it returns. What separates the two labs is execution — Anthropic went with suspension and selection, OpenAI with tiered verification, trading reduced safeguard friction for a cleared review.
How Two Rivals Reached the Same Verdict
One set of weights serves two masters — the model that “can find vulnerabilities for customers” is, to an attacker, a vulnerability finder just the same; that is the built-in dual-use problem of cyber models. Open everything and a lab effectively distributes an attack toolkit to all comers; release nothing and it walks away from the defense market. Tiered access stands alone as the compromise that serves both directions: swap the paywall for an identity wall, and fold KYC into the model release process.
Worth flagging as well: that same day brought advanced account security for ChatGPT, complete with a Yubico hardware-key partnership. Taken as a pair, the announcements show “security” stretching from model capability down to the account and access layer — assembled into a single product message.
The Practical Read for Security Teams
Three things to keep in view. One: teams that run penetration tests or red-team exercises have good reason to file a TAC application now — the verified tier ships fewer guardrails and more practical value; assemble credentials and concrete use cases before submitting, because a vague stated purpose is the most common path to rejection. Two: “thousands of defenders” remains a sliver of the global security workforce, and how fast the government-backed expansion moves will decide when this class of model shifts from privilege to standard equipment — the signal to watch is whether eligibility stretches past critical-infrastructure and enterprise security teams. Three: Altman’s about-face is a standing reminder that public attacks on safety restrictions tend to be repriced the instant one’s own model reaches the same capability threshold. Weigh any gated model by its mechanism — who does the reviewing, what gets logged, how access gets pulled — not by the launch-week rhetoric.