“We want to empower defenders by giving broad access to frontier capabilities, including models which have been tailor-made for cyber security,” OpenAI said.

“This is a version of GPT‑5.4 which lowers the refusal boundary for legitimate cyber security work and enables new capabilities for advanced defensive workflows, including binary reverse-engineering capabilities that enable security professionals to analyse compiled software for malware potential, vulnerabilities and security robustness without needing access to its source code.

“Because this model is more permissive, we are starting with a limited, iterative deployment to vetted security vendors, organisations, and researchers. Access to permissive and cyber-capable models may come with limitations, especially around no-visibility uses like Zero-Data Retention⁠ (opens in a new window) (ZDR).”

It added: “As model capabilities increase, defences need to scale alongside them. We’ve seen steady improvements in agentic coding, which have direct implications for cyber security, and we’ve adapted our approach in step.

“We began cyber-specific safety training with GPT‑5.2, then expanded it with additional safeguards through GPT‑5.3‑Codex and GPT‑5.4, where we also classified the model as ‘high’ cyber capability under our Preparedness Framework.”

GPT-5.4-Cyber comes just as AI rival Anthropic launched Mythos as part of its Project Glasswing, which will see specifically chosen organisations allowed to use the new Claude Mythos Preview model.

Mythos has advanced computer science and cyber security capabilities and has so far found “thousands” of major vulnerabilities in software, including web browsers and operating systems.