Oleksandr Kuzmenko, EditorPublished 3 min readAI-assisted · editor-reviewed
TL;DR
- OpenAI TAC requires Persona KYC identity verification to unlock advanced cyber capabilities.
- Binary reverse engineering models can identify zero-day vulnerabilities like arbitrary file writes.
- Offline PyPI and npm mirrors allow researchers to run security tests in air-gapped environments.
Key facts
- Program Name
- OpenAI Technical Advisory Council (TAC)
- Verification Method
- Persona KYC Identity Check
OpenAI Cyber Capabilities Governance
OpenAI is restricting access to high-capability cyber tools through its Technical Advisory Council (TAC). These specialized model features enable autonomous discovery of vulnerabilities—such as arbitrary file writes in multiplayer game binaries—by reverse engineering compiled software.
Identity Verification and Sandbox Access
Access to unrestricted internet access, package managers (npm, pypi), and advanced binary analysis prompt capabilities now mandates Persona identity verification. Researchers unable or unwilling to complete identity checks are directed to run evaluations against offline mirrors and isolated environments.
When to use
- Evaluating frontier LLMs for automated vulnerability discovery and binary reverse engineering.
- Setting up isolated cyber research sandboxes with mirror package repositories.
When NOT to use
- Standard web development and application coding tasks that do not require low-level reverse engineering.
- Teams unwilling to complete corporate KYC verification with third-party identity providers.
What to do today
- Apply for OpenAI TAC or Anthropic Cyber verification if building vulnerability research agents.
- Configure local PyPI and npm package mirrors for secure, offline LLM agent sandboxes.
Step names are taken from What to do today.
Step names are taken from What to do today. Apply for OpenAI TAC or Anthropic Cyber verification if building vulnerability research agents.. Configure local PyPI and npm package mirrors for secure, offline LLM agent sandboxes.
- Apply for OpenAI TAC or Anthropic Cyber verification if building vulnerability research agents.
- Configure local PyPI and npm package mirrors for secure, offline LLM agent sandboxes.
What the community says
Anthropic's cyber verification is quite a bit stricter I think. Inexplicably, I got accepted into Anthropic's cyber program but OpenAI's TAC doesn't even allow me to verify, says I'm not eligible.
And all that just to allow internet access for npm and pypi? If you've got the bandwidth and disk space, it's very easy to make an offline mirror of both.