Anthropic and OpenAI each opened a new research track that lets vetted security teams work with AI models stripped of most safety filters. Anthropic’s “Cyber Verification Program” and OpenAI’s “Trusted Access for Cyber” give approved researchers direct lines to powerful language models that can generate unrestricted code, prompts and instructions. The move matters because it creates a clear fork in the AI supply chain: a handful of insiders can probe the weakest versions while the rest of the world stays behind stronger guardrails.
Why the programs appeared
Both firms say the initiatives aim to accelerate discovery of vulnerabilities that could be weaponized against their services. By handing a controlled group of experts a sandbox with fewer restrictions, they hope to surface attack vectors before malicious actors find them. The approach mirrors traditional software security, where developers release “bug-bounty” builds to a select audience.
New risk calculus for defenders
The flip side is a two-tier access model that forces every organization to draw a line between “researcher” and “hacker.” That line now becomes a potential attack surface. If an attacker steals credentials, exploits an insider’s access, or tricks the vetting process, they can slip past the guardrails that protect most users. Once inside, the unrestricted model can be coaxed into:
- Generating phishing scripts that evade detection
- Crafting zero-day exploits with detailed code snippets
- Producing convincing social-engineering prompts tailored to specific targets
Security teams that built defenses on the assumption that AI outputs are always filtered must rethink that premise.
How defenders can respond
- Treat the programs as a threat vector. Assume adversaries will try to infiltrate the vetting pipeline and monitor for abnormal login patterns on AI platforms.
- Expand detection beyond the cloud. Look for AI-generated code or text in outbound traffic, especially from privileged accounts.
- Hard-wire policy controls. Enforce strict “least-privilege” rules for any internal use of external AI services, and segment environments that could be reached by a compromised credential.
- Collaborate with the vendors. Stay engaged with Anthropic and OpenAI’s security liaison channels to receive alerts about changes to access criteria or discovered abuses.
The counter-point
Proponents argue that without a safe channel for deep probing, vulnerabilities will stay hidden until they are exploited in the wild. The programs could therefore reduce the overall attack surface by surfacing flaws early. The trade-off is that a “less-guarded” tier invites opportunistic abuse.
What to watch
- Updates to the vetting process from either company
- Reports of misuse stemming from the programs
- Industry-wide shifts in how AI-related attack surfaces are catalogued
The bottom line: the new research tracks give security researchers powerful tools, but they also hand the same tools to anyone who can slip past the gate. Defensive teams must treat the programs as both a source of insight and a fresh avenue for attack.