Numerous cybersecurity professionals recently experienced an abrupt termination of their access to OpenAI's specialized program, Trusted Access for Cyber (TAC). This initiative is designed to grant vetted researchers access to advanced AI models with fewer built-in restrictions, facilitating crucial defensive cybersecurity investigations. OpenAI has acknowledged that this issue stemmed from a technical error impacting a select group of participants, urging them to re-verify their credentials to regain access.
The incident unfolded on a Wednesday, as multiple researchers voiced their concerns on OpenAI's official support forums and on the social media platform X. They reported that upon attempting to access ChatGPT's Cyber interface, a message appeared indicating a failure in identity verification or that their accounts were currently ineligible for the program. This sudden cutoff has raised questions within the cybersecurity community about the stability and management of such critical research platforms.
The TAC program, alongside Anthropic's similar Cyber Verification Program (CVP), plays a vital role in the cybersecurity ecosystem. These programs enable trusted security experts to leverage powerful AI models to identify and report software vulnerabilities, ultimately accelerating the patching process. The goal is to fortify digital defenses against malicious actors by providing legitimate researchers with the tools needed to stay ahead of potential threats, while simultaneously preventing these advanced capabilities from falling into the wrong hands.
To qualify for TAC access, cybersecurity researchers must undergo a rigorous vetting process, which includes submitting personal identification for verification by OpenAI. While the exact scope of this recent issue remains unclear, five researchers confirmed to TechCrunch that they were affected. One individual received an email from OpenAI, attributing the revocation of their Daybreak Blue access (the latest tier of TAC) to a 'technical issue affecting a limited number of users.' The message, shared with TechCrunch, apologized for the inconvenience and requested re-verification.
Further corroborating these reports, another researcher on OpenAI's forums mentioned receiving a similar explanation from support, citing a 'recent technical issue' as the cause for losing access to Daybreak Blue. In both instances, OpenAI instructed the affected researchers to complete the re-verification process to reinstate their access. Interestingly, all the affected researchers interviewed by TechCrunch reside outside of the U.S. and Europe, hinting at a possible regional component to the technical glitch.
OpenAI directed TechCrunch to a post on X, where the company stated that a 'limited set of users' access to Daybreak Blue is no longer active and they will need to re-verify to maintain their access.' Daybreak Blue, introduced on August 10, is designed for individual researchers and offers access to 'frontier general-purpose models, including GPT-5.6 Sol, with safeguards tailored to authorized defensive security work.' This tier is crucial for tasks like vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. Simultaneously, OpenAI also unveiled Daybreak Red, a higher-tier program providing access to models specifically tailored for more advanced cybersecurity research, including authorized vulnerability research, exploit validation, and security testing.
The recent disruption underscores ongoing discussions within the cybersecurity research community regarding the balance between AI model safety and research utility. In recent months, both offensive and defensive security researchers have expressed concerns about the stringent guardrails implemented by companies like Anthropic and OpenAI. They argue that these protective measures, while well-intentioned, can sometimes impede legitimate research efforts aimed at uncovering and mitigating cyber threats. This incident highlights the challenges AI developers face in creating secure yet accessible platforms for critical security work.
