A "cyber" category appears in the Grok API definitions
A new category, "cyber," that permits content related to cyberattacks and defense appears to be in preparation for the developer API used to access xAI's conversational AI "Grok" from outside apps. The X account aitrackerbot, which automatically detects and reports changes to AI services, posted about it on Nov. 1 (12:40 p.m. the same day Japan time). It said a new guideline (a setting that determines how responses are handled) called "cyber" had appeared in the API definitions. The account reported that it works only with API keys that xAI has enabled, and that specifying it with any other key returns a "PERMISSION_DENIED" error. xAI has made no announcement about the matter.
Existing categories only set responses to "decline"
The cyber category appears to be added to a mechanism called "guidelines," which xAI opened to all API users on Oct. 28 (Oct. 29 Japan time). It lets developers specify, for each request, how Grok handles certain types of content.
According to xAI's developer documentation, the current categories are sexual content (nsfw), depictions of violence (violence) and vulgar language (profanity), and the only action that can be specified is "decline." Categories that are not specified receive standard handling. As of Nov. 2, the documentation listed neither the cyber category nor a mechanism for permitting it per key.
While the three existing categories are settings for narrowing responses, cyber appeared as a setting that allows content declined by default only for users approved by xAI. Investigating vulnerabilities (software flaws), penetration testing and malware analysis require handling information that could also be misused.
Rivals offer it only to vetted defenders
OpenAI, Google and Anthropic offer models with relaxed restrictions for cybersecurity only to vetted organizations. OpenAI launched "Daybreak" in June, and on Aug. 11 set up two tiers: "Blue" for defense and "Red," which can also be used to test attacks. It says access is limited to approved individuals and organizations and is managed through identity verification, account security measures, usage monitoring, use restrictions and legal commitments.
Google DeepMind launched the vetted "Fairwind" program on Sept. 2. It prioritizes governments and critical infrastructure operators, among others, and requires background checks, phishing-resistant multifactor authentication and usage logging. More than 650 organizations participate, and Google first offered its top model "Gemini 4 Carbon," announced on Oct. 28, to defenders in this program.
Anthropic on Oct. 6 reorganized its cyber access program into three tiers for defense, penetration testing and organizations working with governments, according to a report by Parameter. Regarding China's DeepSeek, speculation emerged on Oct. 30 that its cyber model cannot be used without a dedicated, identity-verified "cyber key." DeepSeek has made no announcement.
- OpenAI launches its cyber defense initiative "Daybreak"Official
- OpenAI adds two tiers to Daybreak, for defense and for attack testingOfficial
- Google launches the vetted "Fairwind" programOfficial
- Anthropic reorganizes its cyber access program into three tiersOfficial
- xAI adds "guidelines" to the Grok APIOfficial
- Post says a "cyber" category has appeared in the Grok API definitionsLeak
OpenAI's cyber model handles 95% of requests
Whether a user passes vetting greatly changes the range of AI available. According to TechRadar, OpenAI said the share of requests from defenders for code analysis and vulnerability identification that its models handle is about 1.5% for the general-purpose "GPT-5.6 Sol," 2.0% when used in the Blue tier, and 95.0% for "GPT-5.6-Cyber," trained for cyber use. The previous-generation "GPT-5.5-Cyber" was at 57.3%. All are figures announced by OpenAI, and no third-party verification has been presented.
Eligibility and conditions unknown, no announcement from xAI
What has been found so far is only the category name and the behavior that it cannot be used with unapproved keys. Which models it works with, who can apply, and the vetting conditions and pricing are unknown. It is also unclear whether xAI will provide a dedicated model as rivals do, or will only lift restrictions on the existing Grok. The original post came from an automated detection account and has not been confirmed in xAI's documentation or by other media reports.
In May, xAI, along with Microsoft and Google, agreed to provide new models before release to CAISI, a research institute under the U.S. Commerce Department, for national security testing, according to Al Jazeera. The documentation also states that the existing guidelines cannot be used with models such as "grok-4.20-multi-agent," in which multiple AIs divide the work, or with methods that receive results later.
