Trusted access for the next era of cyber defense (openai.com)

by surprisetalk 68 comments 94 points
Read article View on HN

68 comments

[−] alopha 30d ago
That's a lot of waffle to try and say 'we've got a really scary next model coming too real soon, promise!'
[−] guzfip 30d ago
More like they realized how much money they were wasting letting the proles generate slop and vibe code the same CRUD app they rewrote in 5 different JavaScript frameworks a few years back.

The money is in enterprise and government. The consumer market doesn’t remotely pay enough. It’s just the same story with Microsoft purposely making Windows an unusable mess because that’s not where they make their money. It was good to establish themselves, but that market is getting dumped.

[−] flyinglizard 30d ago
Wait six months, get the Chinese version.
[−] NitpickLawyer 30d ago
The move towards "trusted partners" also acts as a way to protect from distillation.
[−] everlier 30d ago
Changes as we speak, z.ai is the first one to show differential pricing
[−] Avicebron 30d ago
I don't think they've added enough cyber. My cyber workflow demands more trusted access for cyber so that I can use these cyber-permissive models for my cybersecurity.
[−] Jedd 30d ago
It's a source of minor, but persistent, annoyance that security people have tried to abscond with the prefix cyber, morphing it into a synonym for security.

Having grown up reading cyberpunk novels about life in cyberspace, a passing interest in cybernetics (though not of the Sirius Cybernetics Corporation variety), it's frustrating to lose a 'this means computer or internet related' prefix.

[−] bee_rider 30d ago
Hmm, I guess this puts the unregulated banking enthusiasts’ stealing of the crypto prefix in a new light.
[−] SturgeonsLaw 30d ago
As far as I can tell, using the word cyber to specifically and only talk about security has come from the kind of suits who take Gartner seriously.

I don't know any techies who use the term like that, unless they're in a role that interfaces with the suits.

[−] ofjcihen 30d ago
Whoa hey now, if they just give out all the cyber all at once they might run out or worse, the bad guys will horde all the cyber for themselves!

No no, best to have them distribute the cyber to us responsibly.

[−] SoftTalker 30d ago
Just wait until you meet the Cybermen.
[−] swyx 30d ago
you make fun of it but i kind of like that the security community has just embraced this kinda old school hokey term. its a short hand. leave them be.
[−] cshimmin 30d ago
Incidentally, I recently learned the origin of the term. Cyber - short for cybernetic - is from the greek κυβερνήτης (kybernetes), meaning helmsman. The original use of cybernetics is in the context of automated control systems, so steering a rudder was a good analogy. It is also the origin for the name k8s.
[−] atoav 30d ago
Just make sure you use cyber periphery (e.g. a cyber keyboard) to type out your cyber prompts and you will be cyb.. ahh.. fine.
[−] zarzavat 30d ago
I'm ready with my robe and wizard hat, Sam.
[−] FacelessJim 30d ago
I would definitely love a glass of smoked cyber
[−] tb0ne1521 29d ago
[dead]
[−] ofjcihen 30d ago
I love that in the era of having LLMs summarize everything all of these companies have opted for what I call the “YouTube streamer apology video” tone and length for these announcements.

These feels more or less like a way to get in the news after Anthropic's Mythos announcement by removing some guardrails. I’m still signing up though.

[−] bunnywantspluto 30d ago
It seems like local LLMs will get popular for cybersecurity if this trend of locking access to models continues.
[−] gavinray 30d ago
I completed the "Trusted Access" verification, but it seems to have unlocked nothing in the OpenAI API or Codex models.

Just FYI for others.

[−] mikewarot 30d ago
It's important to keep perspective, the holes that everyone (including LLMs now) keep finding in pretty much everything are mostly the fault of running things with ambient authority, instead of using systems based on default deny, and capabilities.

I used to think we were 20 years away from a shift to Capabilities based Operating Systems, which were ----> this <---- close to being adopted widely when the PC revolution swiped them aside.

Unfortunately, I think we're about to repeat history, and we're now 20+ years out from actually solving things, AGAIN. 8(

[−] iammjm 30d ago
"trusted" + openai just simply doesn't compute for me any more
[−] greatgib 30d ago
All of that reminds me about how gpt2 was almost too dangerous to be released to the world...
[−] mmooss 30d ago
This approach means only a tiny portion of the population will every qualify. Doesn't that make everyone else beholden to those few, who are beholden to OpenAI?

Another solution is to make software makers responsible and liable for the output of their products. It's long been a problem that there is little legal responsibility, but we shouldn't just accept it. If Ford makes exploding cars, they are liable. If OpenAI makes software that endangers people, it should be the same.

> Democratized access: Our goal is to make these tools as widely available as possible while preventing misuse. We design mechanisms which avoid arbitrarily deciding who gets access for legitimate use and who doesn’t. That means using clear, objective criteria and methods – such as strong KYC and identity verification – to guide who can access more advanced capabilities and automating these processes over time.

KYC isn't democratic and doesn't prevent arbitrary favoritism, it's the opposite: It's used to control people and to favor friends and exclude enemies.

[−] Havoc 30d ago

>democratized access

>partner with a limited set of organizations for more cyber-permissive models.

I get where they're going with this, but still rather hilarious how they had to get a corporate speak expert pull of the mental gymnastics needed for the announcement

[−] nullc 30d ago
Make cyber not cyber.
[−] 2001zhaozhao 30d ago
Requiring verified access is a good idea to mitigate risks from hacking while still giving people access to the latest models. Take notes, Anthropic.
[−] zb3 30d ago

> Ultimately, we aim to make advanced defensive capabilities available to legitimate actors large and small, including those responsible for protecting critical infrastructure, public services, and the digital systems people depend on every day.

Translation: we aim to make defensive capabilities available to US and their vassals so they can protect critical infrastructure, while ensuring countries that are independent can't protect against US attacking their critical infrastructure.

Fortunately, this plan will backfire - the model capability is exaggerated and these "safeguards" don't reliably work.

[−] CompoundEyes 30d ago
Wonder if Cyber would’ve caught the Claude Code source map leak?
[−] rishabhaiover 30d ago
I mean Anthropic clearly wins with the name (Mythos vs 'GPT-5.4-Cyber')
[−] Phelinofist 30d ago
Sounds totally reasonable to trust OpenAI and the sociopath sama.
[−] beyondscaletech 23d ago
[dead]
[−] realisticid 30d ago
[dead]
[−] spacebacon 30d ago
[flagged]
[−] ACCount37 30d ago
Too little too late. OpenAI's shit was nearly worthless for cybersec for what, a year already?

ChatGPT 5.x just tries to deny everything remotely cybersecurity-related - to the point that it would at times rather deny vulnerabilities exist than go poke at them. Unless you get real creative with prompting and basically jailbreak it. And it was this bad BEFORE they started messing around with 5.4 access specifically.

And that was ChatGPT 5.4. A model that, by all metrics and all vibes, doesn't even have a decisive advantage over Opus 4.6 - which just does whatever the fuck you want out of the box.

What's I'm afraid the most of is that Anthropic is going to snort whatever it is that OpenAI is high on, and lock down Mythos the way OpenAI is locking down everything.