OpenAI locks GPT-5.5 Cyber behind a gate, after trashing Anthropic for doing the same thing

OpenAI just announced it’s rolling out GPT-5.5 Cyber, a specialized version of its model tuned for cybersecurity work. But here’s the kicker: it’s only going to “critical cyber defenders” initially.

That’s a direct quote from their announcement. They’re gatekeeping the tool behind some undefined, likely opaque vetting process.

This is the same company that, not long ago, took shots at Anthropic for limiting access to Mythos, its own specialized model. The criticism was loud and clear: restricting access to powerful tools hurts the broader ecosystem, stifles innovation, and concentrates power in the hands of a few.

Now OpenAI is doing exactly that. The hypocrisy is hard to ignore.

Look, I get the argument. Cybersecurity is sensitive. You don’t want GPT-5.5 Cyber falling into the hands of threat actors who could use it to automate phishing campaigns, generate malware payloads, or find zero-days faster than defenders can patch them. That’s a legitimate concern.

But the same logic applied to Mythos, which Anthropic argued could be misused for disinformation, propaganda, or social engineering at scale. OpenAI didn’t buy that argument then. They said Anthropic was being overly cautious, that the benefits of broad access outweighed the risks.

Now they’re singing a different tune. It feels less like principle and more like positioning.

What’s particularly frustrating is the lack of clarity. Who qualifies as a “critical cyber defender”? Is it government agencies? Large enterprise security teams? Certified pen testers? Or just whoever OpenAI decides to let in? The criteria are vague, which makes me suspect this is less about security and more about controlling access for strategic reasons.

I’ve seen this play out before. Companies restrict access early to build hype, then expand slowly while collecting data on usage patterns. It’s a classic playbook. But when you’ve publicly shamed a competitor for the same approach, you lose the moral high ground.

Here’s what I think: OpenAI should either commit to a transparent, well-defined access policy for GPT-5.5 Cyber, or stop pretending they’re any different from Anthropic on this issue. The cat’s out of the bag. They’re both playing the same game.

For now, if you’re not a “critical cyber defender,” you’re out of luck. And if you are one, good luck navigating whatever application process they’ve set up. I’m not holding my breath for a smooth rollout.