LLM Access for Security Research

What changed and why it matters

Major providers — OpenAI, Anthropic, and to a lesser extent Google — have implemented more aggressive filtering on security-adjacent requests. This hit hardest for people running autonomous AI pentest agents (tools like PentestGPT, Shannon, PentAGI) and anyone using LLMs for vulnerability discovery or defense bypass in authorized contexts.

The second constraint is hardware. Running unconstrained open-source models locally requires serious VRAM — 30B+ parameter models need multi-GPU setups or heavy quantization that degrades quality. That leaves most practitioners fully dependent on API providers and their restrictions.

Provider overview

OpenAI — detailed walkthrough

Basic tier (ChatGPT cyber portal)

Submit an individual application through OpenAI's cyber portal. Identity verification is required — typically a passport or equivalent government ID. Organizations apply separately with a description of their security testing use case.

Basic approval reduces refusals on standard security tasks and enables straightforward scenarios. Complex exploitation chains and some offensive tooling still get blocked.

Advanced tier

A separate supplementary form unlocks significantly deeper capability. This tier involves manual review of your actual work — active projects, legal compliance documentation, and demonstrated prior experience in security. The review process is slower but the delta in capability is real once approved.

Anthropic — detailed walkthrough

Anthropic's process is more straightforward. A single application form asks for your use-case description and relevant context. Results are communicated by email (unlike OpenAI, the notification reliably arrives). The access structure parallels OpenAI's — meaningful reduction in filtering, not a full bypass.

Maximizing your approval chances

The difference between approved and rejected applications is almost entirely in how you frame the request. Vague "I'm interested in security" language fails. Specific, legal, experience-backed framing works.

What to include

• Specific technical terminology: "automated vulnerability discovery", "LLM-assisted pentesting", "exploit chain analysis"
• Explicit legal parameters: authorized testing scope, named bug bounty programs (HackerOne, Bugcrowd), internal/proprietary infrastructure
• Evidence of existing experience: GitHub repos, CVEs, HackerOne profile, conference talks, prior research
• Concrete inadequacy statement — show current access is genuinely blocking legitimate work, not that you're curious

What to avoid

• Generic framing ("cybersecurity professional", "interested in AI security")
• Mentioning offensive capability without authorisation context
• CTF-only justification without broader research or professional context

Sample application language

What about local models?

Running open-source models locally removes provider restrictions entirely — but the hardware bar is real. Models at 30B+ parameters require significant VRAM:

• Qwen 30B–36B (Q4): ~20–24 GB VRAM — single RTX 4090 / A6000 is marginal
• Qwen 32B (full precision): requires multi-GPU or A100-class hardware
• Aggressive quantization (Q2–Q3) fits smaller setups but degrades reasoning quality on complex security tasks

For most practitioners without dedicated ML infrastructure, local models are a partial answer at best. The official access programs are the realistic path.