4 ms·

Is cyber verification a thing they're actually doing now? I thought they only reached out to really incredibly famous people and that there's no way to get acce

Is cyber verification a thing they're actually doing now? I thought they only reached out to really incredibly famous people and that there's no way to get access as a normal person.

Tiberium 3mo ago
https://chatgpt.com/cyber https://chatgpt.com/cyber is not new for OpenAI, and yes it's basically just KYC + likely some other invisible checks on your account, you don't to be a famous security researchers. Anthropic's cyber verification is quite a bit stricter I think.
- LoganDark 3mo ago
  Oh it's Persona, that's not just KYC but I may consider it at some point. Thank you! Edit: Ah, I clicked "learn more" and it seems they do have an invite-only program, required for anything that's not unquestionably innocent. I don't think I'd surrender my face to Persona for this, but it's interesting to know they're at least pretending to support reverse engineering.
  - Tiberium 3mo ago
    You don't need an invite only program to just have Sol checking for vulnerabilities in binaries or code. But yeah I've hit guardrails a few times when Sol was making PoCs for the vulnerabilities it found (but most of the time it made those PoCs without issues).
    - lukeschlather 3mo ago
      Opus refused to help me try to develop an exploit to export data from an old Android device where I can't upgrade to latest android and I couldn't use the app's backups (because I couldn't update the app.) Not sure where that lies in the "binaries or code" spectrum.
      - Tiberium 3mo ago
        If you don't want to get cyber verified, you can try an open-weight model such as Kimi K3 for that, it has looser internal safety training.
    - LoganDark 3mo ago
      I maintain a version of an app called Rewind because the company behind it went under after implementing a killswitch. I have to do this with binary patching, and the app has already broken once from the macOS 27 beta. Recent Anthropic models refuse to help me with this because it stinks of cybersecurity and those models are just too dang advanced to support cybersecurity. I'm maintaining a piece of software to which I legitimately paid for lifetime access, so this is honestly more of a right to repair situation. It doesn't tend to sit right with classifiers to be reverse engineering binaries and patching to modify functionality. Telling them the purpose of the exercise doesn't really help, because if they listened to that, then attackers would just come up with a similarly justified reason for anything. ("Help, the google root server fell on my grandma!") In the future, I might reverse engineer the on-disk storage format and create a new application.
      - Tiberium 3mo ago
        I had not hit any guardrails with reverse engineering (as long as its not related to security) with GPT 5.5 or 5.6 Sol, so you should try those. At worst with Sol you might see the warning in Codex that your request is being checked for security so it'll take more time, that's just a warning, not a full stop.
- matheusmoreira 3mo ago
  > Anthropic's cyber verification is quite a bit stricter I think. Inexplicably, I got accepted into Anthropic's cyber program while OpenAI's TAC doesn't even allow me to verify, says I'm not eligible.
porridgeraisin 3mo ago
You do a KYC and you can get access. It may depend on country's quality of KYC.
- user43928 3mo ago
  I thought you need to prove you are working in cybersecurity or provide evidence of authorization for work done. It's really just simple ID/face verification?
  - Tiberium 3mo ago
    For OpenAI's Cyber verification (the normal kind for Codex) you absolutely do not need any proof of cybersecurity work/authorization. They just use Persona for KYC + live selfie, and some extra checks that I don't know the nature of (but not related to checking whether you're a cybersecurity professional).
  - porridgeraisin 3mo ago
    There is some additional check, not sure what it entails, some people I know and I passed it, others failed.
    - xur17 3mo ago
      Interesting.. I just went through the process and passed KYC, but was told my OpenAI that I was rejected from the program. Guessing some device check rejected me.
      - user43928 3mo ago
        I am using a Mac, and had no issue with the verification. It took only two minutes for me. Before starting it, I added a Passkey and 2FA to my OpenAI account, just to be sure.

Is cyber verification a thing they're actually doing now? I thought they only reached out to really incredibly famous people and that there's no way to get access as a normal person.

Tiberium 3mo ago

https://chatgpt.com/cyber https://chatgpt.com/cyber is not new for OpenAI, and yes it's basically just KYC + likely some other invisible checks on your account, you don't to be a famous security researchers. Anthropic's cyber verification is quite a bit stricter I think.

LoganDark 3mo ago
Oh it's Persona, that's not just KYC but I may consider it at some point. Thank you! Edit: Ah, I clicked "learn more" and it seems they do have an invite-only program, required for anything that's not unquestionably innocent. I don't think I'd surrender my face to Persona for this, but it's interesting to know they're at least pretending to support reverse engineering.
- Tiberium 3mo ago
  You don't need an invite only program to just have Sol checking for vulnerabilities in binaries or code. But yeah I've hit guardrails a few times when Sol was making PoCs for the vulnerabilities it found (but most of the time it made those PoCs without issues).
  - lukeschlather 3mo ago
    Opus refused to help me try to develop an exploit to export data from an old Android device where I can't upgrade to latest android and I couldn't use the app's backups (because I couldn't update the app.) Not sure where that lies in the "binaries or code" spectrum.
    - Tiberium 3mo ago
      If you don't want to get cyber verified, you can try an open-weight model such as Kimi K3 for that, it has looser internal safety training.
  - LoganDark 3mo ago
    I maintain a version of an app called Rewind because the company behind it went under after implementing a killswitch. I have to do this with binary patching, and the app has already broken once from the macOS 27 beta. Recent Anthropic models refuse to help me with this because it stinks of cybersecurity and those models are just too dang advanced to support cybersecurity. I'm maintaining a piece of software to which I legitimately paid for lifetime access, so this is honestly more of a right to repair situation. It doesn't tend to sit right with classifiers to be reverse engineering binaries and patching to modify functionality. Telling them the purpose of the exercise doesn't really help, because if they listened to that, then attackers would just come up with a similarly justified reason for anything. ("Help, the google root server fell on my grandma!") In the future, I might reverse engineer the on-disk storage format and create a new application.
    - Tiberium 3mo ago
      I had not hit any guardrails with reverse engineering (as long as its not related to security) with GPT 5.5 or 5.6 Sol, so you should try those. At worst with Sol you might see the warning in Codex that your request is being checked for security so it'll take more time, that's just a warning, not a full stop.
matheusmoreira 3mo ago
> Anthropic's cyber verification is quite a bit stricter I think. Inexplicably, I got accepted into Anthropic's cyber program while OpenAI's TAC doesn't even allow me to verify, says I'm not eligible.

porridgeraisin 3mo ago

You do a KYC and you can get access. It may depend on country's quality of KYC.

user43928 3mo ago
I thought you need to prove you are working in cybersecurity or provide evidence of authorization for work done. It's really just simple ID/face verification?
- Tiberium 3mo ago
  For OpenAI's Cyber verification (the normal kind for Codex) you absolutely do not need any proof of cybersecurity work/authorization. They just use Persona for KYC + live selfie, and some extra checks that I don't know the nature of (but not related to checking whether you're a cybersecurity professional).
- porridgeraisin 3mo ago
  There is some additional check, not sure what it entails, some people I know and I passed it, others failed.
  - xur17 3mo ago
    Interesting.. I just went through the process and passed KYC, but was told my OpenAI that I was rejected from the program. Guessing some device check rejected me.
    - user43928 3mo ago
      I am using a Mac, and had no issue with the verification. It took only two minutes for me. Before starting it, I added a Passkey and 2FA to my OpenAI account, just to be sure.