OpenAI has expanded access to cybersecurity tools for Ukraine, which will be used to support civilian cyber defenses.

These tools are part of OpenAI's "Trusted Access for Cyber" program, which was significantly expanded this year. On April 14, OpenAI launched the GPT-5.4-Cyber model specifically fine-tuned for cybersecurity, featuring tiered access: individual defenders must authenticate via ChatGPT, while businesses apply through OpenAI's sales team, with the highest tier users approved for GPT-5.4-Cyber. This model has binary reverse engineering capabilities and can analyze compiled software; it has a lower threshold for rejecting legitimate security research requests and can identify and fix vulnerabilities at scale. OpenAI plans to extend this program to thousands of verified individual defenders and hundreds of security teams.

OpenAI's cybersecurity tools have already shown quantifiable results. Its code security tool Codex Security has helped fix over 3,000 severe and high-risk vulnerabilities since its launch; Codex for Open Source provides free security scans for over 1,000 open-source projects. OpenAI established a $10 million cybersecurity grant program in 2023. By the end of April, OpenAI expanded the Trusted Access program from a few partners to verified government agencies at all levels in the U.S. OpenAI's national security policy head, Sasha Baker, stated at the time: "As a company, we do not believe it should be up to us alone to decide who can use our tools."

The expansion of access for Ukraine comes amid a sharp rise in global AI cybersecurity threats. On August 27, over 100 companies, including OpenAI, Anthropic, Amazon Web Services, and Microsoft, issued a joint open letter warning that institutions have only "months" to prepare for AI-driven cyberattacks targeting hospitals and water treatment plants. The letter stated: "Our window for strengthening cyber defenses is limited." Previously, water supply systems in several U.S. locations were reportedly attacked using scripts generated by AI. On September 3, OpenAI President Greg Brockman announced at OpenAI headquarters to 300 security leaders that the company would invest $1 billion to launch the "Daybreak Frontline Defenders" program, which aims to protect critical public services globally through subsidized model access, training, technical support, and partnerships; simultaneously, the "Daybreak for America" initiative was launched for local governments, water systems, power companies, and regional banks, with over 35 tech and security service providers integrating OpenAI models into their security tools.

Ukraine is the country most heavily targeted by state-level cyberattacks globally. In December 2015, Russian hackers attacked Ukraine's power grid, causing power outages for approximately 225,000 users, marking the first publicly confirmed cyberattack that resulted in a power outage. In June 2017, the NotPetya malware spread from Ukrainian accounting software to the rest of the world, with estimated losses of around $10 billion. On February 24, 2022, the day the Russia-Ukraine conflict began, the Viasat KA-SAT satellite network was attacked; in December 2023, Ukraine's largest mobile operator, Kyivstar, was attacked, disrupting communications for about 24 million users. Most of these attacks have been attributed to the Russian military intelligence agency's hacker group, Sandworm.

From a market mechanism perspective, this is a technology output driven by geopolitical security needs, without direct transactions involved. The buyers are Ukrainian government agencies, critical infrastructure operators, and civilian cyber defense teams that need to quickly acquire vulnerability discovery, malicious code analysis, and patch development capabilities as the frequency and complexity of attacks rise. In terms of funding flow, OpenAI is providing model capabilities to defenders through subsidized access and grant programs while retaining compliance review and access control rights. Beneficiaries include OpenAI (which embeds cutting-edge models into the security systems of various governments) and cybersecurity service providers integrating OpenAI models into their products; the pressured parties are traditional security consulting and penetration testing services that rely on manual analysis and charge by the hour, as well as Russian hacker organizations that need to reassess attack costs.

Source: Public Information