OpenAI is rolling out GPT-5.4-Cyber and expanding its Trusted Access for Cyber (TAC) program to “thousands” of individual defenders and hundreds of security teams protecting critical software. They’ve been layering cyber-specific safeguards into every model release since GPT-5.2, then boosted safety checks with GPT-5.3-Codex and classified GPT-5.4 as “high” cyber capability under their Preparedness Framework. To earn access, defenders go through automated identity checks and KYC, a move meant to stop bad actors while letting legitimate security pros use the most powerful tools. Their approach rests on three concrete principles. First, democratized access: clear, objective criteria decide who gets advanced defensive features. Second, iterative deployment: they monitor model behavior in the wild, patch jailbreaks and adversarial exploits, then roll updates. Third, ecosystem resilience: they’ve poured $10 million into a Cybersecurity Grant Program, backed open-source security efforts with the Linux Foundation, and built Codex Security—a tool that scans codebases, flags issues, and suggests fixes at scale. In six months of private beta and research preview, Codex Security has fixed more than 3,000 high- and critical-severity vulnerabilities and helped over 1,000 open-source projects. Looking ahead, OpenAI plans to keep aligning model power with defensive measures. As agentic coding grows smarter—automating tasks and understanding context better—defenders get faster detection and patching workflows. Integrating these models directly into developer tools means security checks happen in real time, shifting the industry away from annual audits and toward continuous risk reduction. That alignment—stronger AI, equally stronger guardrails—is the backbone of their cyber-defense strategy.