Expanding Trusted Access for Cyber with GPT-5.5 and GPT-5.5-Cyber

OpenAI has released GPT-5.5-Cyber in limited access to critical infrastructure defenders, and expanded the Trusted Access for Cyber (TAC) framework, which grants broader permissions to verified defenders. TAC is an identity- and trust-based access approach that reduces classifier-based refusals for approved security work, while continuing to block credential theft, evasion, persistence establishment, malware distribution, and compromise of third-party systems.

Defenders who receive TAC can carry out workflows such as vulnerability identification and classification, malware analysis, binary reverse engineering, detection engineering, and patch validation more smoothly. Starting June 1, 2026, individual users must enable Advanced Account Security to use the models with the highest cyber capability, while organizations can alternatively prove they have phishing-resistant authentication in place via SSO.

Access levels are divided into three tiers.

• GPT-5.5 default: for general purpose, development, and knowledge work
• GPT-5.5 with TAC: for most security workflows in verified defensive environments
• GPT-5.5-Cyber: for approved red teaming, penetration testing, and controlled validation, under enhanced verification and account controls

OpenAI explained that GPT-5.5-Cyber is not so much a model that is inherently more powerful than GPT-5.5, but rather an iterative deployment stage tuned to respond more permissively to security-related requests. At the same time, together with Cisco, Intel, SentinelOne, Snyk, Gen Digital, Semgrep, Socket, and others, it laid out a vision to grow a security flywheel spanning vulnerability discovery, patching, detection, response, and network blocking, while GPT-5.5 with TAC was still presented as the starting point for most defense teams.