OpenAI Fires Back at Anthropic Mythos with Powerful GPT-5.4-Cyber

OpenAI has launched GPT-5.4-Cyber, a powerful new model fine-tuned specifically for defensive cybersecurity, while scaling its Trusted Access for Cyber (TAC) programme to thousands of verified defenders.

The model is trained to support defensive cybersecurity workflows, including binary reverse engineering to analyse compiled software for vulnerabilities and malware risk without access to source code. 

OpenAI said the system lowers refusal thresholds for legitimate security use cases while maintaining controls through restricted deployment.

The company said it will extend TAC access to “thousands of verified individual defenders and hundreds of teams responsible for defending critical software,” while rolling out additional access tiers tied to identity verification and trust signals.

“Customers in the highest tiers will get access to GPT-5.4-Cyber,” OpenAI said, describing it as a version of GPT-5.4 fine-tuned for additional cyber capabilities with fewer restrictions.

The AI giant said its cybersecurity strategy rests on three principles, including expanding access with safeguards, iterative deployment, and investing in ecosystem resilience. 

“We aim to make advanced defensive capabilities available to legitimate actors large and small, including those responsible for protecting critical infrastructure, public services, and the digital systems people depend on every day,” the company said.

The TAC programme introduces automated identity verification for individuals and structured access for enterprises. Individuals can verify themselves through OpenAI’s platform, while enterprises can apply through account representatives. Approved users gain access to models with reduced friction around safeguards for dual-use cybersecurity tasks.

Access to GPT-5.4-Cyber will initially be limited to vetted vendors, organisations, and researchers. 

OpenAI said more permissive models “may come with limitations,” especially when the company has limited visibility into how systems are used, such as through third-party platforms or in zero-data retention environments.

The update builds on earlier efforts, including cyber-specific safety training introduced with GPT-5.2 and expanded in GPT-5.3-Codex and GPT-5.4. 

OpenAI said it has also supported a $10 million Cybersecurity Grant Programme and tools such as Codex Security, which monitors codebases and proposes fixes. “Codex Security has contributed to over 3,000 critical and high fixed vulnerabilities,” it said.

OpenAI said cyber risk “is already here and accelerating,” noting that existing models can identify vulnerabilities and support parts of the security workflow. It added that safeguards must evolve alongside model capabilities rather than waiting for a single threshold.

“We expect the need for more expansive defences for future models,” OpenAI said, adding that capabilities could rapidly exceed current systems.

The timing of the announcement appears to be a direct response to last week’s reveal of Anthropic’s Claude Mythos, a frontier model, which caught attention for its strong performance in finding and exploiting software vulnerabilities.