In early 2026, a researcher working on a defensive audit hit a wall. The model refused the request. A second platform refused too. Eventually, a four-character message with no technical content triggered the same security refusal. This wasn’t censorship—it was a practical problem. The researcher was authorized in the real world, and the product had no way to recognize it.
This experience mirrors a growing tension in AI-powered cybersecurity. The same capabilities that help defenders find and patch vulnerabilities can be weaponized by attackers. The industry’s response has been tiered access models that attempt to distinguish legitimate security work from malicious activity. But as one researcher discovered, comparing completion rates between tiers can produce numbers that are technically true and wildly misleading.
OpenAI’s Trusted Access for Cyber (TAC) program represents one of the most ambitious attempts to solve this problem. It scales access based on identity verification, organizational checks, and task authorization. But what does verification actually buy you? How permissive are the permissive models? And most importantly, can a trust-based gating system withstand the pressure it’s about to face?
Section 1: The Three‑Tier Architecture of Trusted Access
OpenAI’s TAC framework isn’t a single access level—it’s a graduated system with three distinct tiers, each calibrated for different use cases and risk profiles.
Tier 1: Default GPT‑5.5
The baseline model includes standard safety safeguards for general‑purpose, developer, and knowledge work. When a user requests a proof‑of‑concept exploit for a published CVE, the default model refuses and typically offers a safer alternative—a version scanner, detection rules, or remediation documentation. This tier serves the vast majority of users and includes safeguards against credential theft, stealth techniques, persistence mechanisms, and exploitation of third‑party systems.
Tier 2: GPT‑5.5 with Trusted Access for Cyber
Verified defenders gain access to a model with “more precise safeguards”—essentially, fewer false positives on legitimate security work. This tier covers the bulk of real‑world defensive workflows: secure code review, vulnerability triage, malware analysis, detection engineering, and patch validation. OpenAI recommends this as the starting point for most security teams.
The key difference is in refusal behavior. The same CVE PoC request that got blocked by the default model now receives a response like: “Here’s a PoC harness for [CVE]. Validate only in authorized environments.” The model trusts that the verified user has legitimate intent and responds accordingly.
Tier 3: GPT‑5.5‑Cyber
The most permissive tier, released in limited preview in May 2026, is reserved for specialized workflows: authorized red teaming, penetration testing, and controlled exploit validation. This is where the 95% completion rate appears—not because the model is more capable, but because it’s far less restrictive about what it will discuss.
Notably, GPT‑5.5‑Cyber is not expected to deliver a major jump in raw cyber performance over standard GPT‑5.5. Instead, it’s trained to be more permissive on security‑related prompts while retaining refusals on obviously malicious requests. The point of this tier is to study specialized authorized workflows under tighter verification and monitoring, not to push raw capability higher.
Section 2: The Numbers That Almost Fooled Everyone
Here is a table from OpenAI’s own documentation, reporting their internal Advanced Cybersecurity Completion Rate—how often a model responds to requests involving exploit‑chain development, authentication bypass, privilege escalation, and similar advanced scenarios:
Configuration Completion Rate
GPT‑5.5 Sol — production safeguards enabled 1.5%
GPT‑5.5 Sol + Daybreak Blue — verified defender 2.0%
GPT‑5.5‑Cyber — Daybreak Red 57.3%
GPT‑5.6‑Cyber — Daybreak Red 95.0%
At first glance, this appears damning: verified individual defenders gain half a percentage point over standard access, while four corporations get ninety‑five percent. Every percentage in that statement is real—but the comparison is wrong.
The benchmark is built around task types that OpenAI places primarily in Red’s intended scope. Daybreak Blue is scoped to vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. Daybreak Red is scoped to authorized penetration testing, red teaming, exploit validation, and controlled vulnerability research. Blue is not designed to broadly complete the requests that benchmark measures.
Comparing Blue’s 2.0% against Red’s 95.0% is like testing a bicycle on a highway and publishing the top speed. The numbers are true. The inference is not.
This is precisely the kind of trap that catches well‑intentioned analysts. A fact with no stated failure mode hasn’t been checked—it’s been liked. The 95.0% figure gets the same treatment: it’s an internal, vendor‑run completion‑rate evaluation. It does not establish 95% correctness, 95% real‑world usefulness, or that any particular individual applicant will receive that model. It measures whether the system responds, within a specific evaluation context.
Section 3: Verification’s Real Value—The Population Effect
A more meaningful data point comes from academic research. In March 2026, Campbell et al. published “Defensive Refusal Bias: How Safety Alignment Fails Cyber Defenders.” They analyzed 2,390 real cases from the National Collegiate Cyber Defense Competition, comparing legitimate defensive prompts against malicious equivalents.
The finding was striking: safety alignment that blocks malicious prompts also blocks a significant percentage of legitimate defensive work. This is the “defender refusal bias”—and it’s measurable at population scale. Verification reduces this bias, but the magnitude is far smaller than the Red/Blue completion gap suggests.
What verification actually buys you is not raw capability—it’s permission to use existing capability without fighting the safety system. A verified defender can ask about exploit chains without triggering classifier‑based refusals. An unverified user cannot. But the model itself hasn’t changed. It’s the same weights, with a different refusal boundary.
This distinction matters because it frames the conversation around trust differently. The question isn’t “who gets the good model?” It’s “who gets to bypass the safety filters for legitimate work?” The model is the same. The permission layer is what changes.
The security implications are significant. From June 1, 2026, individuals accessing GPT‑5.5‑Cyber and the most permissive TAC tiers must enable phishing‑resistant authentication—hardware keys, biometrics, or enterprise SSO with verified MFA. This is a defensive hedge against a specific attack: compromise a defender’s OpenAI account, access the permissive model, and use it to automate attacks against the systems that defender manages. By requiring phishing‑resistant auth, OpenAI raises the cost of that attack from one spear‑phishing email to hardware theft or in‑person compromise.
Best Practices
Apply for verification early. The application process at chatgpt.com/cyber requires submitting credentials and planned use cases. It can take time to process, and access is not guaranteed.
Start with TAC‑enabled GPT‑5.5 before requesting Cyber. Most defensive workflows—code review, vulnerability analysis, malware triage—don’t require the most permissive tier. Requesting Cyber when you don’t need it creates unnecessary friction and may complicate future access.
Document authorized environments. When using permissive models for exploit validation, have clear documentation of your authorized testing scope. This matters not just for compliance but for your own operational security.
Enable Advanced Account Security now. Even if you’re not yet approved for Cyber, phishing‑resistant MFA is table stakes for anyone with access to sensitive code or infrastructure.
Treat the 95% completion rate as a signal, not a guarantee. It measures response rate within a specific evaluation, not real‑world usefulness or accuracy.
Common Mistakes
Comparing Tier 2 and Tier 3 completion rates without context. As demonstrated, this produces numbers that are true and misleading. Always check what’s actually being measured.
Assuming verification means carte blanche. Verified defenders still face restrictions on credential theft, persistence mechanisms, and exploitation of third‑party systems. The model checks for authorization context, not just identity.
Neglecting the verification gap in multi‑user settings. In organizations with shared accounts or lax SSO policies, the access tier applies to everyone using that account. This creates subtle security risks that audit logs may not capture.
Misunderstanding the phishing‑resistant auth requirement. It applies to individuals accessing GPT‑5.5‑Cyber from June 1, 2026. Organizations can alternatively attest that they use phishing‑resistant SSO. This is not optional.
Final Thoughts
OpenAI’s tiered access model represents an honest attempt to solve a real problem: how to give defenders the tools they need without handing attackers the same capabilities. The verification infrastructure is real, the access controls are specific, and the security requirements—particularly the phishing‑resistant authentication mandate—reflect genuine threat modeling.
But the model is only as secure as the verification process. The UK’s AI Safety Institute found that red‑teamers discovered a universal jailbreak bypassing the cyber safeguards in about six hours of effort. OpenAI has since added mitigations, but the pattern is clear: offensive capability exists regardless of who holds the keys.
The core tension remains unresolved: the same capabilities that help defenders find vulnerabilities can be weaponized by attackers. Trust‑based gating is a hedge, not a solution. It raises the cost of misuse but doesn’t eliminate it. For defenders, the message is clear: verification is necessary but not sufficient. The tools you can access under TAC are powerful—but your operational security, authorization boundaries, and attack surface still matter.
Top comments (0)