OpenAI’s TAC Glitch Locked Out Vetted Cybersecurity Researchers

Several cybersecurity researchers reported on August 19 that OpenAI had abruptly removed their access to Trusted Access for Cyber, or TAC. When they opened ChatGPT’s Cyber page, some saw messages saying their identity could not be verified or that their account was ineligible. At least one researcher received a notice that Daybreak Blue access had been revoked. 513

OpenAI said the lockout was caused by a technical problem affecting a “limited set” of users, rather than a deliberate change in policy. The company told affected researchers to complete identity verification again and submit a new application. 813

What happened to the researchers’ access

The incident affected people who said they had already been vetted for OpenAI’s controlled cyber-access program. Instead of recognizing their previous approval, the Cyber page treated some accounts as unverified or newly ineligible. Reports also said that, for some users, repeating the process did not immediately restore the earlier approval and support could not simply override the new decision. 716

OpenAI did not publish a total number of affected accounts. The clearest public count is five researchers interviewed or contacted in reporting, so five is a visible reported minimum—not a confirmed total. 1317

What TAC, Daybreak Blue and Daybreak Red are

Trusted Access for Cyber is a reviewed-access framework that gives approved people and organizations narrowly scoped access to cyber-capable models for authorized work. It is not itself a model. Approval can be limited to a particular person or service, OpenAI organization or workspace, API project, model and product surface. 22

The two Daybreak tiers serve different purposes:

• Daybreak Blue provides frontier general-purpose models, including GPT-5.6 Sol, with safeguards tailored to verified defensive work. OpenAI lists uses such as vulnerability triage, secure-code review, malware analysis, detection engineering, incident response and patch validation. 2425
• Daybreak Red provides purpose-trained cybersecurity models for more advanced authorized workflows, including penetration testing, red teaming, exploit validation and controlled vulnerability research. It requires separate approval and provisioning; Blue approval does not automatically grant Red access. 222425

The distinction matters because TAC access is not a blanket exemption from safety controls. It is bounded access tied to a verified user or organization, an approved environment and an authorized purpose. OpenAI’s documentation also specifies that approved users must use the intended workspace, API project, model and access path. 2227

How researchers qualify—and what the recovery process required

Qualification involves identity verification and review of the proposed use case and operating environment. For organizations, approval may also be configured at the workspace or API-project level. Daybreak Red adds a separate eligibility decision and stronger access controls. 222431

After the August 19 failure, affected users were asked to verify their identities again and reapply. That requirement created a practical problem: re-verification was a new eligibility step, not an explicit guarantee that the previous approval would be restored. Reports said some researchers who followed the instructions were still told they were ineligible. 716

For teams troubleshooting normal Daybreak access, OpenAI says to check the approved organization or workspace, the intended API project, the authorized access path and the exact model alias or ID. Daybreak Blue uses gpt-daybreak-blue or gpt-5.6-sol; Daybreak Red uses gpt-daybreak-red or gpt-5.6-cyber. 27

Was the problem concentrated outside the U.S. and Europe?

There is a notable geographic pattern in the public reporting: all five researchers identified in the coverage were said to live outside the United States and Europe. That raises the possibility of a regional or identity-verification failure. 913

But the evidence does not establish geographic discrimination. OpenAI has not disclosed the full affected population, the countries involved or the technical cause of the failure. The most supportable conclusion is narrower: the public cases showed a geographic concentration, while the scope and explanation remained incomplete. 49

Why AI companies create cyber-verification programs

Frontier AI models can help defenders find vulnerabilities, review code, analyze malware, improve detections and validate patches. The same capabilities can also support intrusion, exploit development or other harmful activity. Controlled-access programs try to preserve the defensive benefits for accountable researchers while adding identity checks, approved-use restrictions, monitoring and other safeguards. 2425

Anthropic uses a comparable approach. Its Cyber Verification Program is intended for security professionals conducting legitimate work such as vulnerability research, penetration testing and red teaming, while its broader safety framework combines access controls with real-time and asynchronous monitoring. 444750

This is a form of defense in depth: no single filter is expected to handle every risk. Access decisions, model safeguards, monitoring and post-hoc review are layered together to reduce misuse. 43

Why researchers criticize the guardrails

The central difficulty is that cybersecurity is inherently dual-use. The same request may describe legitimate vulnerability validation in one context and preparation for an attack in another. Researchers therefore argue that broad automated filters can block authorized work, including exploit reproduction, malware analysis, red-team exercises and vulnerability testing. 134150

Criticism also focuses on opaque eligibility decisions, repeated identity checks, slow or ineffective appeals and the possibility that independent researchers or people outside major Western markets may be disadvantaged. The TAC outage sharpened those concerns because a technical failure interrupted the defensive research the program was designed to support—and, according to some reports, the recovery process created a second eligibility hurdle. 713

The bottom line

The available evidence points to an accidental TAC lockout, not a confirmed policy reversal. OpenAI blamed a technical error, asked affected researchers to re-verify and reapply, and did not disclose how many accounts were affected. Five publicly identified researchers were reported to live outside the U.S. and Europe, but that pattern alone cannot prove geographic bias.

The larger lesson is about reliability as much as safety: when access to high-capability cyber tools depends on tightly scoped verification, an identity or permissions failure can become a serious research bottleneck. Controlled access may reduce misuse, but it also needs transparent eligibility rules, dependable recovery and a credible way to correct false lockouts.