TAC stands for OpenAI’s Trusted Access for Cyber program. In practical terms, it is an access-control layer for cyber-focused capabilities, where identity assurance matters as much as the account itself. Instead of relying only on passwords or one-time codes, TAC can require stronger sign-in methods such as hardware-backed passkeys.
This matters because the login boundary is part of the threat model. Phishing-resistant authentication makes it harder for attackers to steal access through fake login pages, token replay, or password reuse. For defenders, TAC shows how modern platforms can protect sensitive workflows by tightly gating who can reach them. It also highlights an operational tradeoff: stronger sign-in controls reduce risk, but they increase the importance of enrollment, backup, and lost-device recovery so legitimate users do not get locked out.