OpenAI CEO Sam Altman announced the rollout of GPT-5.5-Cyber, a cybersecurity-focused model, aiming to deliver it to critical cyber defenders within days. This development is part of a broader strategy to enhance AI deployment in cybersecurity and comes shortly after Anthropic unveiled Claude Mythos Preview, which discovered numerous software vulnerabilities deemed too dangerous for public release.
Altman stated on X, “We will work with the entire ecosystem and the government to figure out trusted access for cyber. We want to rapidly help secure companies/infrastructure.” The rollout accompanies an extensive cybersecurity action plan from OpenAI, articulated around five pillars including democratizing access to tools and coordinating efforts between government and industry.
GPT-5.5-Cyber builds on the earlier GPT-5.4-Cyber model, launched in mid-April as part of OpenAI’s Trusted Access for Cyber program, which included $10 million in API grants to vetted security organizations. Unlike Anthropic’s approach with Mythos, which limited access to 50 organizations, OpenAI plans to distribute GPT-5.5-Cyber more broadly to governments, critical infrastructure operators, security vendors, cloud platforms, and financial institutions.
Claude Mythos, introduced on April 7, autonomously discovered thousands of zero-day vulnerabilities across major operating systems and browsers, showcasing capabilities achieved through enhanced reasoning and coding functions. The model executed complex exploits, such as chaining multiple vulnerabilities to create significant security risks.
Anthropic allocated up to $100 million in usage credits and committed $4 million in donations to open-source security but chose not to release Mythos to the public. Following the initial announcement, Anthropic released Claude Opus 4.7, a less capable model lacking Mythos’s sophisticated cybersecurity features.
OpenAI has yet to publish benchmarks comparing GPT-5.5-Cyber to Mythos. The base GPT-5.5 model received a “High” rating on OpenAI’s cybersecurity risk scale, below the “Critical” threshold for autonomous zero-day exploit development. As noted by security professionals, the ability to identify software flaws at scale raises significant concerns about control and safety in cybersecurity applications.
