On May 7, 2026, OpenAI described how GPT-5.5 and a limited-preview model called GPT-5.5-Cyber are being deployed to support cybersecurity work across the defensive ecosystem. The company framed the initiative around a trust-based framework, Trusted Access for Cyber (TAC), that adjusts model behaviour and safeguards depending on who is using the model and for what purpose.
How the access levels differ
OpenAI presented three access tiers: GPT-5.5 (default) for general-purpose and developer tasks; GPT-5.5 with Trusted Access for Cyber, which reduces classifier-based refusals for verified defensive workflows; and GPT-5.5-Cyber, a more permissive preview intended for specialized, authorized tasks such as controlled red teaming and penetration testing.
The company provided example prompts to illustrate differences. In one, GPT-5.5 declined to produce an exploit for a published CVE and offered defensive alternatives. With TAC enabled, the same prompt returned proof-of-concept files and exploitation steps for authorized testing. GPT-5.5-Cyber produced a live-target exploit workflow in the example and reported successful local testing against a proof-of-concept target, according to OpenAI.
Intended uses, safeguards and partnerships
OpenAI says GPT-5.5 with TAC is the recommended starting point for most defenders, supporting tasks such as secure code review, vulnerability triage, malware analysis, detection engineering and patch validation. GPT-5.5-Cyber is intended for narrower, higher-risk workflows under stronger verification and monitoring.
The company listed partner vendors it is working with to integrate these capabilities across discovery, detection and response, and supply chain tooling—including Cisco, CrowdStrike, Palo Alto Networks, Oracle, Zscaler, Cloudflare, Akamai, Fortinet, Intel, Qualys, Rapid7, Tenable, Trail of Bits, SpecterOps, SentinelOne, Okta, Netskope, Snyk, Gen Digital, Semgrep and Socket.
OpenAI said organizations and individual users will face stricter identity and account controls as access expands. Individuals granted higher access must enable Advanced Account Security beginning June 1, 2026; organizations may alternatively attest to phishing-resistant authentication via single sign-on. OpenAI also noted GPT-5.5-Cyber is in limited preview for defenders securing critical infrastructure, and enterprises can request trusted access through their OpenAI representative while individuals can verify at chatgpt.com/cyber.
Original source: OpenAI News