What is GPT-5.5-Cyber, and who is allowed to use it?

Yesterday, Thursday, May 7, 2026, OpenAI announced GPT-5.5-Cyber, a special version of its GPT-5.5 model, in a limited preview for security teams that defend critical infrastructure: the systems behind power, water, finance, hospitals and other services people depend on. It is not a public product. Organizations must be vetted and approved before they can use it.

The announcement is less about a new, smarter model and more about a new rule for who gets what. OpenAI says the first GPT-5.5-Cyber preview was trained mainly to be more permissive on security tasks, meaning it says no less often, rather than to be more capable than the regular GPT-5.5. The capability is roughly the same; what changes is how much the model will help, and with whom.

Why a "permissive" model exists at all

Security work is dual-use: the same knowledge that helps a defender find and fix a weakness could help an attacker exploit it. AI models now handle this kind of work well. OpenAI rated GPT-5.5 as "High" for cybersecurity under its Preparedness Framework when it launched two weeks ago, and added stricter filters to the public version.

Those filters are classifiers, small automatic systems that scan a request and block it if it looks risky. They protect the public, but they also get in the way of legitimate professionals. A hospital's security team testing its own network, or a company checking that a patch really closes a hole, can hit the same refusals as a stranger with bad intentions.

OpenAI's answer is to verify the person, not just judge the request. Its program for this is called Trusted Access for Cyber, or TAC: a framework based on identity and trust that decides how much help each user receives.

The three levels of access

OpenAI lays out three tiers. The worked example below shows how they differ in purpose, using OpenAI's own descriptions.

Level	Who it is for	How the model behaves	Typical uses
GPT-5.5 (default)	Everyone with access to GPT-5.5	Standard safeguards	General work, coding, writing
GPT-5.5 with TAC	Verified defenders	Fewer refusals for defensive work in authorized settings	Reviewing code for flaws, sorting vulnerability reports, studying malware, writing detection rules, checking patches
GPT-5.5-Cyber (preview)	A smaller set of vetted critical-infrastructure defenders	The most permissive, with stronger verification and account controls	Authorized red teaming and penetration testing

Two terms from that table need explaining. Red teaming means playing the attacker on purpose, with permission, to find weaknesses before real attackers do. Penetration testing is a structured version of the same idea: hired testers try to break into a system they are authorized to test and report what they found.

Even at the top level, OpenAI says some things stay blocked, such as stealing passwords, deploying malicious software or attacking systems the user does not own or have permission to test. Axios adds that writing malware remains off-limits.

For most teams, OpenAI recommends the middle level, GPT-5.5 with TAC. It says that tier covers the large majority of defensive work, and that GPT-5.5-Cyber matters only when authorized work still runs into refusals.

How access is checked

The more freedom a model has, the more OpenAI wants to know about who is using it. The steps it describes:

Individuals verify their identity at chatgpt.com/cyber.
Enterprises ask the OpenAI contact who handles their account.
Starting June 1, 2026, individual members who use the most permissive models must turn on Advanced Account Security, which requires sign-in protection that resists phishing (fake login pages that steal passwords). Organizations can instead confirm that their own company sign-in system already meets that standard.
Use of the permissive models is monitored for misuse and limited to approved purposes.

OpenAI is also working with major security companies, including Cisco, CrowdStrike, Palo Alto Networks, Cloudflare, Intel, SentinelOne and Snyk, which build products that detect attacks, filter traffic or scan software for known problems. The idea is that improvements reach many customers through those products. Selected maintainers of important open-source projects can also apply for its Codex Security tool, which helps find and fix flaws in their code.

Why it matters

The announcement shows two leading labs taking different paths with very capable security models. Axios reports that Anthropic has let only about 40 organizations use its Claude Mythos Preview model, while OpenAI keeps a guarded version for the public and offers looser versions to approved applicants. Axios also cites a test by the UK AI Security Institute in which GPT-5.5 completed a 32-step simulated attack on a corporate network in 2 of 10 attempts, compared with 3 of 10 for Mythos Preview.

The stakes are now a government matter too. Axios reports that the White House is weighing executive actions that might give federal officials a larger role in future model launches. OpenAI says it expects access to widen as identity checks and monitoring improve, which suggests this tiered approach may become a template for other sensitive abilities.

Try it: Find a recent security notice for software you use, such as a browser or phone update note. Paste it into a chatbot and ask it to explain, in plain language, what the problem was, who is affected and what you should do.

What does trusted access mean for ordinary users and small teams?

For most people, nothing changes in daily use. The regular GPT-5.5 can still help you understand security news, review your own code for common mistakes or set up safer passwords and backups. You may occasionally see a request flagged as possible cybersecurity risk, especially while OpenAI tunes its filters.

Small teams that do real defensive work, such as an IT company that manages clients' networks, can apply for the middle level at chatgpt.com/cyber if refusals keep blocking legitimate tasks. Expect identity checks and stronger account security as part of the deal. The top GPT-5.5-Cyber level is, for now, meant for a limited group protecting critical systems.