OpenAI Releases GPT-5.4-Cyber Model for Defensive Cybersecurity with Restricted Access

Apr 16, 2026

OpenAI launched GPT-5.4-Cyber on April 14, 2026, a specialized AI model engineered for defensive cybersecurity tasks with unprecedented binary reverse engineering capabilities that can identify vulnerabilities like buffer overflows and analyze malware behavior without source code. Access is restricted exclusively to verified security professionals who complete identity verification through the Persona service and obtain top-level certification through OpenAI's Trusted Access for Cyber program, launched in February 2026 alongside a $10 million grant fund. The release comes exactly one week after competitor Anthropic released Claude Mythos, with OpenAI targeting thousands of individual defenders and hundreds of security teams compared to Mythos's initial 40 institutional partners. The model represents a significant capability jump from GPT-5's 27% CTF benchmark score in August 2025 to GPT-5.1-Codex-Max's 76% score in November 2025. Unlike standard OpenAI models, GPT-5.4-Cyber cannot be accessed through public APIs or third-party proxy services like APIYI, requiring identity credentials rather than payment credentials.

GPT-5.4-Cyber's Core Capabilities and Technical Features

▪OpenAI officially launched GPT-5.4-Cyber on April 14, 2026.
▪GPT-5 achieved a 27% Capture-the-Flag benchmark score in August 2025.
▪GPT-5.4-Cyber can identify potential vulnerabilities including buffer overflows, format strings, and use-after-free without source code.
▪GPT-5.4-Cyber is a cyber-permissive fine-tuned variant of GPT-5.4 specifically engineered for defensive cybersecurity tasks.
▪GPT-5.4-Cyber has a lowered refusal threshold for security-related research compared to standard consumer-grade models.
▪GPT-5.1-Codex-Max achieved a 76% CTF benchmark score in November 2025.
▪GPT-5.4-Cyber publicly supports binary reverse engineering capabilities for the first time, allowing it to analyze compiled executables without needing source code.

Access Restrictions and Trusted Access Tier System

▪OpenAI launched the Trusted Access for Cyber project in February 2026.
▪OpenAI released a $10 million cybersecurity grant fund in February 2026.
▪GPT-5.4-Cyber is restricted exclusively to security researchers and organizations that have obtained the highest level of certification through OpenAI's Trusted Access for Cyber program.

Third-Party API Availability and Alternative Solutions

▪GPT-5.4-Cyber is only available to accounts with Trusted Access for Cyber top-level verification via ChatGPT or dedicated enterprise workspaces.

Competitive Positioning Against Anthropic Claude Mythos

▪Anthropic released Claude Mythos on approximately April 7, 2026.
▪GPT-5.4-Cyber was released exactly one week after Anthropic's Claude Mythos.
▪Claude Mythos was released approximately one week before GPT-5.4-Cyber.
▪Claude Mythos initially partnered with approximately 40 institutions.

Perspective of OpenAI

▪OpenAI's Trusted Access for Cyber certification program aims to ensure only verified security professionals can access GPT-5.4-Cyber.
▪OpenAI's $10 million cybersecurity grant fund demonstrates commitment to supporting the defensive security community.

Perspective of Anthropic

▪Claude Mythos's partnership with approximately 40 institutions represents a more selective initial deployment compared to OpenAI's thousands-of-users target.