OpenAI publishes a cyber defense plan for the AI era, aimed at governments and critical infrastructure

On April 29, 2026, OpenAI published a plan called Cybersecurity in the Intelligence Age. It proposes that powerful AI tools should not be locked away within a narrow circle of players, but passed more quickly to vetted defenders. The company's logic is simple: attackers will use AI anyway, so the winner is not whoever keeps models locked up longest, but whoever strengthens defenses fastest.

The five pillars of the plan

OpenAI believes cybersecurity is entering a new phase. The same models that help find vulnerabilities, speed up patches and automate defense are already being used in attacks: for phishing, reconnaissance, malware development and evading security systems. The problem is not only the models themselves. The digital environment is already overloaded with legacy systems, uneven patching, insecure software and vulnerabilities in open source dependencies. Against that backdrop, the company has organized its response into five areas:

• expand access to AI tools for defenders
• coordinate between government, industry and AI labs
• strengthen protection of frontier models themselves and the sensitive knowledge around them
• maintain visibility into and control over how such models are deployed and used
• give ordinary users tools for personal digital protection

OpenAI's key idea is neither full openness nor rigid containment, but "controlled acceleration." The company states plainly that advanced models for cyber tasks will almost certainly spread more widely over time. The question is therefore no longer whether different players will get them, but whether democratic institutions can turn today's technological lead into a lasting defensive advantage. Otherwise, defenders will be chasing the attackers' market rather than staying ahead of it.

Who gets access

The central mechanism in the plan is called Trusted Access for Cyber, or TAC. It is a tiered access program for more powerful and more "permissive" models, intended for legitimate defensive work. The level of access will depend on trust in the user, their task and the scale of the defensive impact. In other words, the more powerful and sensitive the tool, the stricter the vetting, security requirements, monitoring and terms of use. The goal is to remove unnecessary friction for defensive work without opening the door to destructive scenarios.

First, OpenAI wants to scale TAC to several groups. Priority goes to defenders in federal, state and local government agencies, as well as large players that can protect thousands or millions of end users: security platforms, hyperscalers, infrastructure companies, software supply chain defenders and critical infrastructure operators. The company singles out the financial sector as one of the main targets of sophisticated attacks. Small hospitals, school districts, water utilities, municipalities and local operators would get access through trusted intermediaries: MSSPs, industry organizations, large vendors and programs backed by CISA. The company later wants to extend this framework to US allies.

"Cybersecurity is a team effort."

Opening access is not enough if the market has no shared channel for exchanging threat information. So the second pillar of the plan covers coordination between government, industry and AI labs: a common threat model, fast sharing of operational intelligence on attacks, selection of the most important sectors and use cases, and use of existing government channels for response. OpenAI stresses that no single lab sees the full picture of abuse, so coordination among labs is not an add-on but a mandatory part of defense.

How protection will be strengthened

The third and fourth pillars concern OpenAI itself and the rules for deploying such systems. The company promises to protect models, weights, sensitive environments and internal knowledge more strictly against leaks, theft, unauthorized copying and distillation. The measures include tighter access control, segmentation of sensitive environments, expanded monitoring, protection of software and hardware supply chains, and stronger control over privileged access and insider risks. To test its resilience, OpenAI intends to bring in external teams more actively, and it points to its expanded partnership with Microsoft on collective defense.

At the deployment level, the company is betting on a risk-based model. Ordinary users keep baseline protections: limits on model behavior and automated system checks. For trusted users with mission-critical tasks, access will be tiered, with identity verification, legal attestations, baseline security commitments, abuse reporting and additional monitoring. If risk rises, OpenAI reserves the right to quickly tighten blocks, lower limits, require re-authentication, downgrade access levels or revoke access entirely.

The fifth pillar concerns mass-market users. According to the company, ChatGPT users already send more than 15 million messages a month asking whether something is a scam. OpenAI wants to develop this use case further: helping people recognize suspicious messages, set up stronger passwords and MFA, respond to breaches, and recover faster from fraud or account compromise. In the coming days, the company also promises new security features for ChatGPT accounts to make basic digital hygiene easier and more accessible.

What this means

OpenAI has publicly taken a position in favor of selective expansion of access, rather than a model in which powerful cyber tools stay with a few chosen organizations. If this approach works, AI-based defense will become not a niche service for experts but an infrastructure layer for governments, clouds, developers and ordinary users. If it does not, the debate over who can be trusted with frontier models, and on what terms, will only intensify.