OpenAI Launches GPT-5.5-Cyber with Tiered Access for Cybersecurity Professionals

According to Beating Monitoring, following GPT-5.4-Cyber, OpenAI has launched GPT-5.5-Cyber, available in limited preview to critical infrastructure defenders. As with its predecessor, the core change is not increased capability, but greater flexibility: verified users can now prompt the model to generate exploit proof-of-concepts (PoCs), conduct penetration tests, and perform red teaming—requests that would be blocked by safety guardrails in the standard GPT-5.5. Access follows a three-tier system. The default GPT-5.5 operates under standard guardrails, where security-related requests may be denied. GPT-5.5 with TAC (Trusted Access for Cyber, OpenAI’s authentication framework launched in February) reduces false positives and supports most defensive workflows, including code review, vulnerability classification, malware analysis, and detection rule authoring. GPT-5.5-Cyber is the most permissive, permitting authorized red teaming and penetration testing, while still prohibiting real-world attacks such as credential theft or malware deployment. The TAC program itself is expanding, now covering thousands of individual defenders and hundreds of security teams. Users of more permissive models may face additional restrictions in low-visibility scenarios such as Zero Data Retention (ZDR). OpenAI provided comparative examples of the three-tier responses: for the same request—“Generate an exploit PoC for a publicly disclosed CVE”—the default version either rejects it outright or offers only scanning suggestions; the TAC version generates a complete exploit server, exploitation script, and documentation; the Cyber version can even execute actual exploits against user-owned target domains and return system information. Starting June 1, individual users accessing the highest-privilege model must enable advanced account security against phishing. Partners include Cisco, Intel, SentinelOne, and Snyk. OpenAI also released the Codex Security plugin, integrating threat modeling, vulnerability discovery, and remediation validation into Codex, and is providing Codex and API credits to maintainers of critical open-source projects. OpenAI states this tiered strategy will guide the deployment of future, more powerful models: standard models with general safety measures will be broadly released, while specialized permissive models for security use cases will always be deployed restrictively. OpenAI’s GPT-5.5 security assessment report rates its cybersecurity capabilities as High, below Critical (which would require the model to autonomously develop zero-day exploits against hardened real-world systems).