https://openai.com/form/enterprise-trusted-access-for-cyber/

"Daybreak enables vetted enterprise customers and cybersecurity practitioners to use our most capable models for dual-use cybersecurity work."

They explicitly give out access to those who will make a big announcement of bugs found. OpenAI does not want projects to fix bugs themselves so it can have more bugs and better marketing.