OpenAI arms cyber defenders with $10M in credits

Not every software maintainer has a 24/7 security operations center ready to handle zero-day panics on a Friday night.

OpenAI is trying to tip the scales back toward the good guys. On April 16, the company announced an expansion of its Trusted Access for Cyber program, backed by $10 million in API credits through its Cybersecurity Grant Program.

Millions in credits, heavy hitters in tow

The free API credits are aimed squarely at teams on the front lines of defense. The initial cohort includes supply-chain security tools Socket and Semgrep, alongside Calif and Trail of Bits, both known for deep vulnerability research.

OpenAI is also opening applications to more teams with proven track records of squashing bugs across open-source code and critical infrastructure.

Meanwhile, the roster of participating enterprises reads like a who's who of global finance and enterprise tech. Backers include Bank of America, BlackRock, BNY, Citi, Cisco, Cloudflare, CrowdStrike, Goldman Sachs, JPMorgan Chase, Morgan Stanley, NVIDIA, Oracle, Palo Alto Networks, and Zscaler.

The pitch is simple: put frontier cyber tools into the hands of organizations managing the world's most complex digital environments, and use their feedback to build reliable safety guardrails.

Sandboxing GPT-5.4-Cyber

The elephant in the room is always dual-use risk. Any model smart enough to auto-patch complex vulnerabilities can theoretically be flipped to exploit them.

To address this head-on, OpenAI granted access to a specialized model, dubbed GPT-5.4-Cyber, to both the U.S. Center for AI Standards and Innovation (CAISI) and the UK AI Security Institute (UK AISI). Both agencies will run independent evals on its defensive prowess and safety mechanisms.

OpenAI insists that access will scale strictly alongside verified trust, ensuring legitimate defenders move faster without handing attackers a silver bullet.

Why it matters

Cybersecurity has always been an asymmetric game: attackers only need to find one loose thread, while defenders have to protect everything. Frontier models could finally help even those odds, especially for overworked open-source maintainers who keep the internet running for free.

OpenAI played this smartly. Rolling out advanced cyber capabilities would usually trigger immediate regulatory sirens. By bringing in blue-chip Wall Street banks and voluntarily handing GPT-5.4-Cyber over to U.S. and UK security institutes, OpenAI essentially built a regulatory shield while establishing itself as the de facto platform for enterprise defense.

Still, the boundary between automated remediation and automated exploitation is razor-thin. Restricting advanced capabilities behind a vetted trust wall makes sense, but it also creates high-stakes gatekeeping over who gets to wield the best defense.