OpenAI is expanding access to its newest cybersecurity-focused AI models for European companies and institutions, offering verified defenders controlled use of GPT-5.5 and GPT-5.5-Cyber as governments and major industries brace for a faster era of vulnerability discovery and patching.

The San Francisco-based company said its Trusted Access for Cyber program will be available to European organizations in critical sectors, including telecommunications, financial services, public services and security operations. Reuters reported Tuesday that companies gaining access include Deutsche Telekom, BBVA, Telefónica, Sophos and Scalable Capital, with OpenAI framing the move as a way to help defenders identify vulnerabilities, validate fixes and respond to threats more quickly.

The rollout gives OpenAI a prominent role in Europe’s cybersecurity policy debate at a time when regulators, banks and infrastructure operators are assessing whether frontier AI models can be safely used for highly sensitive defensive work. Unlike general-purpose chatbot access, Trusted Access for Cyber is designed around identity verification, approved-use scoping and differentiated safeguards for organizations carrying out authorized security tasks.

OpenAI’s own description of the program says GPT-5.5 with Trusted Access for Cyber is intended to reduce unnecessary refusals for vetted defenders working on legitimate tasks such as vulnerability identification, triage, malware analysis, binary reverse engineering, detection engineering and patch validation. The company says safeguards remain in place to block malicious activity, including credential theft, stealth, persistence, malware deployment or exploitation of third-party systems.

GPT-5.5-Cyber, now in limited preview, is positioned for a smaller set of more specialized workflows, including authorized red teaming, penetration testing and controlled validation. OpenAI says that more permissive access is paired with stronger verification and account-level controls, rather than being released as a general model. The company has also said individual users with the most cyber-capable and permissive access will be required to use stronger account security beginning June 1, 2026, while organizations can attest to phishing-resistant authentication through their single sign-on systems.

The European Commission has also been offered access to OpenAI’s cybersecurity features, according to Reuters and BankInfoSecurity. A Commission spokesperson cited in those reports said the arrangement could allow EU officials to follow the deployment of the model more closely and examine security concerns. Details of who within the Commission or related EU bodies would receive access remain unsettled, and talks were expected to continue this week.

The move comes after Anthropic’s Mythos model intensified concern across the security community. Reuters reported that the model’s ability to identify software weaknesses and reason through exploit paths has prompted banks and government users to accelerate remediation work. For enterprise defenders, that creates a double-edged reality: the same capabilities that can help security teams find flaws faster may also become dangerous if made available to threat actors or poorly supervised users.

OpenAI is trying to distinguish its approach by emphasizing controlled defensive access rather than broad release. Emmanuel Marill, OpenAI’s managing director for Europe, the Middle East and Africa, told Reuters that the company must block dangerous activity while ensuring trusted defenders have tools that are useful for protecting systems, finding vulnerabilities and responding quickly. That balance is likely to remain a central policy question as AI labs seek commercial customers in regulated sectors while regulators demand visibility into model behavior.

For European companies, the timing is significant. The EU’s Digital Operational Resilience Act, known as DORA, has tightened information and communications technology risk requirements for the financial sector. German financial regulator BaFin warned Tuesday that frontier AI models will force companies to patch vulnerabilities much faster than before, with BaFin President Mark Branson saying older patch-management cycles measured in months may need to shrink to days or even hours. He also cautioned that faster patching can create operational risk of its own, citing the disruption caused by the 2024 CrowdStrike update failure.

OpenAI’s partner list suggests the company is targeting several layers of the cyber-defense stack. Telecom operators such as Deutsche Telekom and Telefónica sit close to network infrastructure. Financial firms such as BBVA and Scalable Capital face regulatory pressure to protect customer data and trading or banking systems. Sophos, a U.K.-based cybersecurity provider, could use the models inside managed detection and response workflows, where analysts must quickly connect alerts, logs, malware indicators and remediation steps.

The technology question is whether AI models can reliably reduce the time between vulnerability disclosure, exposure analysis and patch validation. OpenAI says GPT-5.5 can support secure code review, vulnerability triage, malware analysis, detection engineering and patch validation. It has also described a broader “security flywheel” in which researchers, software supply-chain tools, detection providers and network-security vendors use model assistance to move faster from discovery to mitigation.

That vision has clear Silicon Valley implications. OpenAI, Anthropic, Google and other U.S. AI developers are increasingly competing not just on general reasoning benchmarks but on enterprise trust, sector-specific deployments and government access arrangements. Cybersecurity is a particularly sensitive market because models can be dual-use: the same reasoning that helps a defender validate whether an owned system is exposed can help an attacker chain vulnerabilities against an unauthorized target.

OpenAI’s program also reflects a broader business strategy. Reuters reported that the company has said it is setting up a new company with more than $4 billion in initial investment to help organizations build and deploy AI systems, and plans to acquire AI consulting firm Tomoro to help scale that effort. If completed, that would give OpenAI more capacity to support enterprise implementation beyond model access alone.

For U.S. policymakers and technology companies, the European rollout will be closely watched as a test case for frontier-model governance. If OpenAI can demonstrate that cyber-capable models improve defense without increasing misuse, it could strengthen the case for controlled access programs in other regions and sectors. If the rollout exposes verification gaps, operational failures or regulatory disagreements, it could sharpen calls for stricter oversight of dual-use AI systems.

For now, the announcement marks a practical escalation in the AI cybersecurity race. OpenAI is offering European defenders stronger tools, European authorities are seeking closer visibility, and regulated companies are preparing for a world in which vulnerabilities may be found, tested and patched at machine speed. The unresolved question is whether governance can move quickly enough to keep those capabilities primarily in defensive hands.