OpenAI puts $1 billion behind cyber defense after unveiling AI that can find zero-days

OpenAI announced Thursday it will provide $1 billion in subsidized access to its cybersecurity models over the next six months, prioritizing water systems, electricity grid operators, and local governments, after disclosing that its new Astra model can autonomously find and exploit software vulnerabilities. The offer covers discounted access to Daybreak, OpenAI's cyber product, and is aimed at helping critical infrastructure and open-source maintainers defend against AI-powered attacks.

OpenAI said Thursday it will provide $1 billion in subsidised access to its cybersecurity models over the next six months, days after disclosing that its newest model can find undocumented software flaws and write code to exploit them without human help. The money is not a fund or a grant programme, and covers discounted access to Daybreak, the cyber product OpenAI launched earlier this year, along with training and technical support. Daybreak comes in two tiers, with Blue running the company's standard models for routine defensive work and Red giving approved organisations specialised cyber models for more sensitive tasks. About 2,000 organisations already use it, per the company’s blog. The priority list names water and wastewater systems, electricity grid operators, state and local governments, community and regional banks, nonprofits and open-source maintainers. Crypto exchanges, custodians and blockchain protocols are not mentioned anywhere in the announcement. Open-source blockchain and crypto software fits that category, however. Bitcoin Core, Ethereum's clients and the libraries DeFi protocols depend on are maintained by small teams and unpaid volunteers guarding code that secures billions of dollars. The urgency comes from what OpenAI disclosed on Monday. Its new Astra model can find previously unknown software flaws and turn them into working attacks without a human guiding each step, crossing a cybersecurity threshold that until recently belonged largely to expert hacking teams, as CoinDesk reported. Read More: OpenAI says its new 'Astra' AI can build attacks without human help Eligible organisations apply through the Daybreak website. OpenAI said it intends to extend the model to partner countries in the coming weeks. The pledge comes amid a tepid stretch for crypto applications and network technologies. In August, a flaw in BTCPay Server, open-source software merchants use to accept bitcoin payments, exposed the credentials controlling Lightning nodes, and attackers drained funds before a fix went out. Core Lightning, one of the main programs for running the Lightning network that moves small bitcoin payments cheaply, told operators last week to disconnect their machines after a wave of AI-generated vulnerability reports turned up several real flaws. Separately, Coldcard, a hardware wallet that stores bitcoin offline, shipped new firmware after a $114 million theft, saying frontier AI models had helped catch bugs unrelated to the original problem. The series of exploits culminated in more than three dozen companies, such as heavyweights Coinbase, Block, BitGo, Blockstream, ARK Invest, among others, publish an open letter to AI labs seeking early access to their strongest models for security work. The firms stated that AI labs were vetting who gets their strongest models while attackers obtained them regardless — leaving the people maintaining Bitcoin's code with weaker tools than the people attacking it.