OpenAI dropped GPT-5.3-Codex, a reasoning model that’s a beast at cybersecurity—it can autonomously work for hours or days finding and fixing software vulnerabilities. The big idea is to flip the script: instead of worrying about AI helping hackers, they want defenders to get the good stuff first. That’s why they’re piloting Trusted Access for Cyber, a verification system that lets vetted security pros do high-risk cyber work without friction. To sweeten the deal, they’re putting $10 million in API credits toward cyber defense. The model is trained to refuse clearly malicious requests, like stealing credentials, and they’re adding classifier monitors to catch shady behavior. But they admit it’s tricky—something like ‘find vulnerabilities in my code’ could be either ethical patching or an attack prep. Why it matters: This is a major shift from locking down powerful AI to actively empowering defenders, which could raise the baseline of software security for everyone, but only if access policies stay tight as open-weight models flood the market.