OpenAI Blueprint for Empowering Cyber Defenders and AI Governance
AI is fundamentally altering the speed, scale, and economics of cybersecurity, presenting both powerful defensive capabilities and significant new risks. This blueprint proposes concrete actions for governments and industry to strengthen protections and empower cyber defenders before advanced offensive AI capabilities become widely available.
The Urgency of the Defender’s Window
AI systems can significantly assist cybersecurity defenders by helping them detect intrusions, find and fix vulnerabilities, and respond to attacks. However, these same capabilities can be leveraged by malicious actors, creating new risks when AI systems operate outside their intended boundaries. OpenAI identifies a 'defender’s window'—a limited opportunity to integrate advanced AI into defensive operations and strengthen protections before advanced cyber offensive capabilities become common.
Three Pillars of the Governance Blueprint
Drawing on lessons learned from internal misalignment and security incidents, the blueprint puts forward concrete proposals across three key areas to strengthen the democratic governance of frontier AI.
Strengthening Safety and Security for Advanced AI
To mitigate risks inherent in frontier models and agents, organizations must establish clearer responsibilities regarding AI security. This requires implementing robust safeguards to ensure models are secure, that dangerous behavior can be detected, and that reliable shutdown controls are maintained for all operations under an organization’s control.
Modernizing Cybersecurity for the Intelligence Age
Equipping defenders requires comprehensive modernization of current cybersecurity practices. This pillar focuses on providing defenders with advanced tools, technical support, and specialized training. Furthermore, it mandates addressing longstanding cybersecurity weaknesses and investing in securing essential services by replacing outdated systems.
Building Resilient and Adaptive Public Institutions
Governments must enhance their capacity to manage advanced AI risks. This involves strengthening government evaluations and independent technical assessments of AI systems. Additionally, the blueprint calls for establishing consistent incident reporting requirements and improving the coordination and recovery processes during cyber incidents.
Shared Responsibility and Call to Action
Addressing the risks created by advanced AI requires collaboration between AI developers and governing bodies. AI labs bear the responsibility to address the risks their systems generate and contribute to strengthening societal defenses. Concurrently, governments must possess the necessary expertise, resources, and authority to protect the public as AI capabilities advance.
OpenAI encourages policymakers to act immediately, establishing necessary safeguards, learning from operational experience, and strengthening requirements as the technology continues to evolve.