To unlock the full defensive potential of these capabilities while reducing the risk of misuse, we are piloting Trusted Access for Cyber: an identity and trust-based framework designed to help ensure enhanced cyber capabilities are being placed in the right hands. This reflects our broader approach⁠ to responsibly deploying highly capable models. In addition, we are committing $10 million in API credits to accelerate cyber defense.

It is very important the world adopts frontier cyber capabilities quickly to make software more secure and continue to raise the bar of security best practices. Highly capable models can help organizations of all sizes strengthen their security posture, reduce response times, and improve resilience, while enabling security professionals to better detect, analyze, and defend against the most severe and targeted attacks. These advances have the potential to meaningfully raise the baseline of cyber defense across the ecosystem if they are put to work in the hands of people focused on protection and prevention.

There will soon be many cyber-capable models with broad availability from different providers, including open-weight models, and we believe it is critical that OpenAI’s models strengthen defensive capabilities from the outset. This is why we are launching a trust-based access pilot that prioritizes getting our most capable models and tools in the hands of defenders first.

It can be difficult to tell whether any particular cyber action is intended for defensive usage, or to cause harm. For example, “find vulnerabilities in my code” could be part of responsible patching and coordinated disclosure—or it could be used to identify software vulnerabilities to help exploit a system. Because of that ambiguity, restrictions intended to prevent harm have historically created friction for good-faith work. Our approach aims to reduce that friction while still preventing malicious activity.