OpenAI puts $10M in credits behind vetted cyber defenders

OpenAI is broadening its cyber-defense program from controlled model access into a larger ecosystem push, with $10 million in API credits and a roster that includes major banks, security vendors, and public AI safety evaluators. The important shift is that GPT-5.4-Cyber is not being treated like a normal public model rollout. Access expands with verification and safeguards, while OpenAI tries to prove that stronger cyber models can reach defenders without giving the same capability to everyone by default.

In the April 16 source post, OpenAI says Trusted Access for Cyber is meant to scale access according to trust, validation, and safeguards. The first participants span open-source security teams, vulnerability researchers, enterprises, public institutions, nonprofits, and smaller groups that may lack around-the-clock security coverage.

The funding detail is concrete: OpenAI says it has committed $10 million in API credits through its Cybersecurity Grant Program. Initial recipients include Socket and Semgrep for software supply-chain security, plus Calif and Trail of Bits for vulnerability research paired with frontier models. OpenAI is seeking more teams with a record of finding and fixing vulnerabilities in open source software and critical infrastructure.

The enterprise roster is also meant to signal real-world testing at scale. OpenAI lists Bank of America, BlackRock, BNY, Citi, Cisco, CrowdStrike, Goldman Sachs, iVerify, JPMorgan Chase, Morgan Stanley, NVIDIA, Oracle, SpecterOps, and Zscaler among organizations supporting the effort. It has also given GPT-5.4-Cyber access to the U.S. Center for AI Standards and Innovation and the UK AI Security Institute so they can evaluate cyber capabilities and safeguards.

The bet is narrow but consequential: advanced models may help defenders triage vulnerabilities, inspect code, and respond faster when disclosure timing is hostile. The hard part is governance. If access tiers are too tight, smaller maintainers stay behind. If they are too loose, offensive capability spreads faster than the defensive learning OpenAI wants. This program will be judged by whether it produces measurable open-source and critical-infrastructure wins, not by the length of the participant list.