OpenAI has confirmed an error caused the revocation of access for some cybersecurity researchers to its Trusted Access for Cyber (TAC) program. The company stated that affected users will need to reapply for access.
The incident highlights the challenges in managing access to powerful AI tools for cybersecurity research, potentially hindering efforts to discover and patch vulnerabilities and raising questions about equitable access for researchers globally.
Several cybersecurity researchers reported that OpenAI abruptly revoked their access to the Trusted Access for Cyber (TAC) program, a special initiative providing vetted individuals with advanced AI models with fewer restrictions for security research. OpenAI has since confirmed that the issue stemmed from an internal error.
Multiple researchers shared on OpenAI's support forums and social media platform X that upon attempting to access ChatGPT's Cyber page, they encountered messages indicating their identity could not be verified or that their account was ineligible. The TAC program, along with Anthropic's similar Cyber Verification Program (CVP), is designed to equip trusted defenders with powerful AI tools to identify and report bugs and vulnerabilities more efficiently, thereby accelerating the patching process and preventing malicious actors from exploiting these models.
Access to TAC requires researchers to undergo an identity verification process by OpenAI. The exact reasons for the revocations and the total number of affected individuals remain unclear. However, TechCrunch spoke with five researchers who experienced the issue. One researcher shared an email from OpenAI stating that their access to Daybreak Blue, the most recent tier of TAC, was revoked due to a "technical issue affecting a limited number of users." The message acknowledged the error and stated it was not the desired user experience.
In forum discussions, other researchers reported similar explanations from OpenAI, citing a "recent technical issue." In both instances, OpenAI requested that the affected researchers reapply and complete the verification process. All five researchers interviewed by TechCrunch indicated they reside outside of the U.S. and Europe, suggesting the revocations might be geographically specific.
OpenAI referred TechCrunch to a tweet confirming that "a limited set of users' access to Daybreak Blue is no longer active and they will need to re-verify to maintain their access." Daybreak Blue, launched on August 10, provides access to general-purpose models like GPT-5.6 Sol, with safeguards tailored for defensive security work, supporting tasks such as vulnerability discovery, secure code review, malware analysis, incident response, and patch validation. A higher tier, Daybreak Red, offers models specifically for authorized vulnerability research, exploit validation, and security testing.