Hacker News Reader

Comment by LoganDark | Hacker News Reader

Is cyber verification a thing they're actually doing now? I thought they only reached out to really incredibly famous people and that there's no way to get access as a normal person.

View on HN

https://chatgpt.com/cyber is not new for OpenAI, and yes it's basically just KYC + likely some other invisible checks on your account, you don't to be a famous security researchers. Anthropic's cyber verification is quite a bit stricter I think.

Oh it's Persona, that's not just KYC but I may consider it at some point. Thank you!

Edit: Ah, I clicked "learn more" and it seems they do have an invite-only program, required for anything that's not unquestionably innocent. I don't think I'd surrender my face to Persona for this, but it's interesting to know they're at least pretending to support reverse engineering.

You don't need an invite only program to just have Sol checking for vulnerabilities in binaries or code. But yeah I've hit guardrails a few times when Sol was making PoCs for the vulnerabilities it found (but most of the time it made those PoCs without issues).

Opus refused to help me try to develop an exploit to export data from an old Android device where I can't upgrade to latest android and I couldn't use the app's backups (because I couldn't update the app.) Not sure where that lies in the "binaries or code" spectrum.

If you don't want to get cyber verified, you can try an open-weight model such as Kimi K3 for that, it has looser internal safety training.

I maintain a version of an app called Rewind because the company behind it went under after implementing a killswitch. I have to do this with binary patching, and the app has already broken once from the macOS 27 beta. Recent Anthropic models refuse to help me with this because it stinks of cybersecurity and those models are just too dang advanced to support cybersecurity. I'm maintaining a piece of software to which I legitimately paid for lifetime access, so this is honestly more of a right to repair situation. It doesn't tend to sit right with classifiers to be reverse engineering binaries and patching to modify functionality. Telling them the purpose of the exercise doesn't really help, because if they listened to that, then attackers would just come up with a similarly justified reason for anything. ("Help, the google root server fell on my grandma!")

In the future, I might reverse engineer the on-disk storage format and create a new application.

I had not hit any guardrails with reverse engineering (as long as its not related to security) with GPT 5.5 or 5.6 Sol, so you should try those. At worst with Sol you might see the warning in Codex that your request is being checked for security so it'll take more time, that's just a warning, not a full stop.

> Anthropic's cyber verification is quite a bit stricter I think.

Inexplicably, I got accepted into Anthropic's cyber program while OpenAI's TAC doesn't even allow me to verify, says I'm not eligible.

You do a KYC and you can get access. It may depend on country's quality of KYC.

I thought you need to prove you are working in cybersecurity or provide evidence of authorization for work done.

It's really just simple ID/face verification?

For OpenAI's Cyber verification (the normal kind for Codex) you absolutely do not need any proof of cybersecurity work/authorization. They just use Persona for KYC + live selfie, and some extra checks that I don't know the nature of (but not related to checking whether you're a cybersecurity professional).

There is some additional check, not sure what it entails, some people I know and I passed it, others failed.

Interesting.. I just went through the process and passed KYC, but was told my OpenAI that I was rejected from the program. Guessing some device check rejected me.

I am using a Mac, and had no issue with the verification. It took only two minutes for me.

Before starting it, I added a Passkey and 2FA to my OpenAI account, just to be sure.

Reply on news.ycombinator.com