AI for security research: what OpenAI, Anthropic, and Google allow, and where data goes

The Morse teamPublished October 31, 20267 min read

As of October 2026, OpenAI, Anthropic, and Google all allow AI for security research on systems you own or are authorized to test, but their standard models still refuse parts of that work, and the programs that relax those refusals ask for your identity and, at Anthropic, require keeping your data. That leaves pentesters and bug bounty hunters trading answers against keeping client data where the engagement says it must stay.

We read OpenAI's, Anthropic's, and Google's usage policies, cyber access programs, and data pages, plus Bugcrowd's and HackerOne's codes of conduct and NIST's testing guide, on October 23, 2026. This page is about authorized testing only, and assumes written authorization for every system you test. It covers policy and privacy, and contains no payloads, exploits, or jailbreak prompts.

Can you use AI for security research?

Yes, if the work is authorized. Anthropic's Usage Policy, in the version effective November 12, 2026, bans finding or exploiting vulnerabilities without the owner's authorization, then adds that this "does not prohibit security research, testing, or tool development conducted on systems you own or operate, with the authorization of the system owner, or within the scope of an authorized bug bounty program or vulnerability disclosure policy" (Anthropic).

OpenAI's Usage Policies have no carve-out. They prohibit "destruction, compromise, or breach of another's system or property, including malicious or abusive cyber activity," and "unsolicited safety testing," in the version in effect since October 29, 2025 and the one taking effect November 20, 2026 (OpenAI). Authorization appears in its cyber program instead.

Google's Generative AI Prohibited Use Policy, last modified December 17, 2024, has none either. It forbids "circumvention of abuse protections or safety filters" and says Google "may make exceptions" for "educational, documentary, scientific, or artistic considerations" (Google).

What each AI company's policy says about security work

Every cell is from the company's own page, read October 23, 2026. "Restricted" means default models may block it and a verified program is the route in.

Why do ChatGPT and Claude refuse security questions?

Because the request reads the same whichever side you're on. OpenAI's own example is "find vulnerabilities in my code," which could serve "responsible patching and coordinated disclosure" or an attack, so its models refuse clearly malicious requests and "automated classifier-based monitors" watch for suspicious cyber activity (OpenAI, February 5, 2026). Anthropic lists what its general models still handle: "secure code review, threat modeling, patching known issues, finding vulnerabilities in your own source code, and triaging security alerts" (Anthropic). How refusal training works inside a model is in what is an abliterated model.

What do OpenAI's Daybreak and Anthropic's Cyber Verification Program ask for?

Your identity, your account security, and, at Anthropic, your data. Neither program comes with zero data retention by default.

On the providers' own pages, the official way past refusals runs through a verified account, and at Anthropic through retained data. OpenAI deserves credit on training. While Advanced Account Security, which Daybreak requires, is on, "conversations are not used to train OpenAI models" (OpenAI). Google's Fairwind is the only one of the three that offers zero retention, and it's aimed at governments and large operators rather than independent researchers.

Can you paste client scan output into ChatGPT?

Only if your engagement allows it, and the platforms say so in writing. Bugcrowd's Code of Conduct, updated November 25, 2025, says not to use generative AI tools "except in a manner that avoids disclosure of confidential information," keeping "the confidentiality of all identified findings between you, Bugcrowd, and the program owner" (Bugcrowd). HackerOne encourages "the responsible use of AI tools" but says a program's confidential data "must never be published without coordinating" with its owner (HackerOne).

NIST's testing guide, SP 800-115, says test results "should be considered sensitive" because they "identify vulnerabilities that an adversary can exploit." It recommends encrypting assessment data, limiting who can reach it, and writing rules for "gathering, storing, transmitting, and destroying test data" into the rules of engagement, and notes that clients may require NDAs barring disclosure "to unapproved entities" (NIST, September 2008).

Google's Gemini privacy page puts it most directly: "Please don't enter confidential information that you wouldn't want a reviewer to see" (Google). We compare training settings across apps in which AI companies train on your data. This isn't legal advice. Read your NDA and rules of engagement, and ask the client before any of their data goes into a tool.

How Morse keeps client findings away from AI companies

With mainstream AI, both problems start with the provider, which runs the filter that refuses you, keeps the chats you send, and asks who you are before it relaxes the filter. Morse is built so your chat history stays on your device, and you choose for each chat who can read the message.

On paid plans, picking an unfiltered model gives you answers other apps refuse, including help testing your own security. You sign in with a code sent to your email, or with Google. Use it only on systems you own or are authorized to test. The Free plan doesn't include unfiltered models; they come with Pro, at $19 a month, and with Max.

Each chat also has a privacy mode, which decides who can read it:

• E2EE, for client data no one should read. Scan output, internal hostnames, and embargoed findings go here. Your browser checks the secure enclave's hardware attestation, then encrypts the message so only that enclave can read it, and Morse's servers relay ciphertext they can't read. The enclaves are run by third-party providers, not by Morse, and the guarantee rests on the enclave hardware and attestation working as designed. E2EE has no web search, so paste in the advisory text you need. How end-to-end encrypted AI chat works walks through each check.
• Private, for research you'd rather no host keep. It runs open-weight models like DeepSeek, Kimi, and GLM, plus Grok. Morse has zero data retention agreements with its inference, search, and other providers, so the hosts agreed to keep nothing, and where a provider confirms zero retention on each reply, Morse checks it.
• Anonymous, for GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address. The provider sees the message and may keep it for a limited time to check for abuse, under its own policy, so leave client names and hostnames out.

In every mode, your chat history is stored in your browser, encrypted, and not on Morse's servers, which don't keep your messages or log what you write. Morse doesn't train AI on your chats, sell your data, or show ads (privacy policy). Clearing your browser deletes your chats, and Morse can't recover them, so copy findings into your report storage as you go.

Which AI for refusals, client data, and write-ups

• Refusals on authorized work: OpenAI and Anthropic may lower them after identity verification and approval, and Anthropic's program requires data retention. On Morse, pick an unfiltered model on Pro.
• Client data and embargoed findings: follow the rules of engagement first. If they allow an AI tool, start the chat in E2EE.
• Public advisories and write-ups: Private, or Anonymous for a frontier model.
• Training: in ChatGPT, turn off "Improve the model for everyone." On Morse, there's nothing to turn off.

Try a chat from the Morse home page without an account, or start free with no card needed. Unfiltered models and end-to-end encrypted chats come with Pro, at $19 a month.