Tag: AI cybersecurity

  • OpenAI’s $1B in Six Months Shows AI Cyber Defense Hinges on Who Can Apply the Fixes

    OpenAI’s $1B in Six Months Shows AI Cyber Defense Hinges on Who Can Apply the Fixes

    TL;DR · 30-second read

    The Short Version

    OpenAI, the company behind ChatGPT, is offering $1 billion worth of discounted security tools and training to the people who protect water systems, electricity networks, local governments and small banks. It wants that used within six months.

    OpenAI expects attacks using artificial intelligence to become far more common soon, and many of these organizations run on small teams and old systems.

    Here is the catch: software can spot a weak point, but someone at your local utility still has to fix it. A discount cannot hire that person.

    OpenAI announced Daybreak for Frontline Defenders on September 3, 2026, committing $1 billion globally to subsidized access to its Daybreak cyber models and products, along with training, technical support and partnerships. The company is targeting consumption of the subsidized access over the next six months, starting in the United States, and says it intends to extend the model to partner countries in the coming weeks.

    The initiative prioritizes water and wastewater systems, electric grid operators, state and local governments, community and regional banks, nonprofits and open-source maintainers. It also includes a training pilot with the Multi-State Information Sharing and Analysis Center (MS-ISAC) and more than 35 partner products and services through the Daybreak Defense Network.

    Executive Summary

    OpenAI is moving its AI cyber-defense effort from a product for vetted security teams to a subsidized program aimed at organizations with far fewer resources. Daybreak, launched earlier this year, already serves thousands of defenders across 2,000 approved organizations and workspaces. The new commitment targets operators that run essential services with limited staff and aging systems.

    The scale is the headline, but the six-month target may be the more revealing detail. It implies a rapid drawdown of subsidized capacity by organizations that OpenAI itself describes as short of budget, tools and specialized expertise. Subsidies lower the cost of using AI models. They do not, on their own, add the people who must review a proposed fix and put it into service.

    That makes delivery the real measure of this program. The question is less whether AI can surface vulnerabilities, meaning exploitable weaknesses in software or systems, than whether a small water utility or community bank can act on what the tools find before attackers do.

    A $1 Billion Pledge With a Short Clock

    The $1 billion figure is about 1,000 times the support OpenAI recently offered after attacks on U.S. water systems, when it made available up to $1 million in no-cost API credits (prepaid use of its models by software), Daybreak access and technical assistance. Spread evenly over six months, a $1 billion target works out to roughly $167 million a month. That is simple arithmetic rather than a disclosed spending plan, but it shows how quickly usage would need to grow.

    OpenAI describes the commitment in two slightly different ways. One passage covers subsidized access, training, technical support and partnerships, while another refers to $1 billion in subsidized Daybreak access. The difference matters because a dollar of discounted model usage is not equivalent to a dollar of hands-on assistance for a utility. The six-month figure is also framed as a target, so it should be read as an ambition rather than a guaranteed outcome.

    Why the Constraint Moves From Finding Flaws to Fixing Them

    Daybreak’s advertised workflow runs from reviewing legacy code (older software still in service) and analyzing suspicious activity through validating vulnerabilities, ranking risks, and developing and testing fixes. AI can compress much of that chain, and a subsidy can make it affordable. The final steps still land on an operator that must accept a change and apply it to a system people depend on. Even OpenAI’s own Defense Factory, which it describes as a continuous, agent-first operation, prepares tested fixes for review rather than removing that review.

    This is where the money and the bottleneck can separate. For a team with limited staff, more findings can mean a longer queue unless capacity to triage and remediate grows at the same time. Remediation here means the practical work of correcting a problem. Water systems illustrate the stakes: OpenAI says teams in its earlier support effort confirmed fixes while systems stayed operational and communities kept receiving service. That is the outcome the program needs to repeat, and it depends on people who know those systems as well as on the models.

    OpenAI appears to recognize the issue, stating that access to capable models is only useful if defenders have the training and support to use them, and that the goal is to fix vulnerabilities faster rather than simply find more of them. The practical implication is that model usage can scale quickly, while guided help tends to scale with people and time. Utilities, local governments and small banks are the groups most exposed to that mismatch, and it is why the volume of subsidized usage alone would be a weak measure of success.

    Reaching the Under-Resourced Is a Different Distribution Problem

    The organizations OpenAI names among current Daybreak users include cybersecurity companies, defense organizations and law enforcement. These are specialist security users, while the new priority list includes rural-scale and community institutions that may lack dedicated security teams. Serving them is likely to require a different onboarding motion, not just a lower price.

    The announced channels point in several directions. The MS-ISAC pilot is the most direct route, since that organization provides threat intelligence, incident response support and information sharing to thousands of public-sector organizations. But the pilot begins with an initial group of public sector and water system defenders, and its broader benefit is described as something that could come eventually. The Daybreak Defense Network offers scale through more than 35 partner products and services, though OpenAI frames those as bringing its models into the hands of the enterprise, which is not the same audience as a small municipal utility.

    OpenAI’s utility convening shows reach of a kind: this week’s gathering included participants representing 40 states and the District of Columbia, whose organizations collectively serve more than half of the U.S. population. That is a meaningful measure of engagement, but it counts who was represented in the room rather than how many systems have been hardened.

    The Urgency Claim Is a Forecast

    OpenAI argues that AI-enabled attacks will become far more widespread and sophisticated in the coming months, leaving a narrowing “defender’s window.” The direction of that argument is plausible as models improve, and more than 150 organizations joined OpenAI’s call for collective action the week before. Still, the timing is a forecast, and OpenAI did not accompany it with incident data or a measured baseline. Its water-sector example is also descriptive, listing the kinds of work teams completed without reporting how many flaws were fixed or how quickly.

    There is also a commercial dimension worth stating plainly. OpenAI is both the source of the warning and a supplier of the response, which does not make the warning wrong but does make independent outcome data more valuable. The longer-term economics matter as well: a budget-constrained operator that builds workflows around subsidized tools will eventually need to know what those tools cost once the subsidy ends.

    Background

    OpenAI launched Daybreak earlier in 2026 to let verified public and private sector defenders use advanced AI for authorized cyber defense. The company reports thousands of defenders using it across 2,000 approved organizations and workspaces. The week before this announcement, OpenAI and more than 150 organizations across cybersecurity, technology, critical infrastructure, finance and AI called for collective action on AI-era cyber defense.

    The new program focuses on operators that OpenAI says defend complex and often aging systems without the budgets, tools or specialist expertise of large enterprises. That group includes the water utilities, grid operators, local governments and community banks that provide everyday services, which is why their security capacity matters well beyond the cybersecurity industry.

    Sources

    Source: Daybreak for Frontline Defenders: $1B to protect essential services, OpenAI’s September 3, 2026 announcement of its $1 billion cyber-defense commitment.

  • As CISA Faces a 30% Cut, California Makes AI Cyber Defense of Utilities a State Job

    As CISA Faces a 30% Cut, California Makes AI Cyber Defense of Utilities a State Job

    TL;DR · 30-second read

    The Short Version

    California’s governor announced a plan on August 10 to use artificial intelligence to find and block hackers targeting the systems behind tap water, electricity and emergency phone lines.

    The timing is the story. The federal government has proposed cutting its main cyber defense agency’s budget by about 30 percent, and a monitoring service that small towns used for free for two decades has lost its federal funding and is starting to charge. California is taking on more of that protection itself. It has not yet said how much it will spend.

    On August 10, 2026, California Governor Gavin Newsom announced an AI Cyber Defense Program, which his office describes as first-in-the-nation, according to the announcement published on CA.gov. The Governor directed state agencies to set up the program inside the California Cybersecurity Integration Center (Cal-CSIC), using AI for vulnerability detection, network hardening and incident response; to expand AI-enabled cyber defenses to local governments and critical infrastructure partners; and to designate an AI Cybersecurity Officer in every state agency.

    The Governor’s office tied the move to AI-enabled attacks and to federal pullbacks: a proposed Fiscal Year 2027 cut of roughly $707 million, about 30%, to the Cybersecurity and Infrastructure Security Agency (CISA), the end of federal funding for the Multi-State Information Sharing and Analysis Center (MS-ISAC) in late 2025, and the winding down of the current funding phase of a $1 billion federal state-and-local cyber grant program.

    Executive Summary

    California is building a state-run layer of AI-assisted cyber defense for the systems residents depend on most: water, power, transportation and emergency communications. The program sits in Cal-CSIC, the state’s existing hub for threat intelligence and incident coordination, and extends beyond state agencies to local governments and critical infrastructure operators.

    The significance is less the technology than the division of labor. For two decades, small water districts, counties and cities leaned on free or grant-funded federal services for round-the-clock monitoring and incident help. With those services shrinking or moving to paid models, California is positioning the state as the provider of last resort for AI-era cyber defense.

    What the announcement does not yet include is a budget, a timeline or eligibility rules, so the scale of what the state can actually absorb remains an open question.

    Why Utility Cyber Defense Is Becoming a State Job

    The most consequential directive is not the AI itself but the second item on the list: expanding access to advanced cybersecurity capabilities, including AI-enabled defenses, for local governments and critical infrastructure partners. That commits the state, through Cal-CSIC, to supplying defensive capacity to organizations it does not run: municipal water systems, county networks, and the operators of the power, transportation and emergency communications services that Cal OES Director Caroline Thomas Jacobs named.

    The Governor’s office set this against three federal changes. The proposed FY2027 budget would cut CISA, the federal agency that provides field support, incident response and defensive tools, by roughly $707 million, about 30% below earlier levels. MS-ISAC, which for more than twenty years gave thousands of state, local, Tribal and territorial governments 24/7 monitoring and threat intelligence at no direct cost, lost federal funding in late 2025 and is moving to paid models. And the State and Local Cybersecurity Grant Program, launched with $1 billion under the Bipartisan Infrastructure Law, is nearing the end of its current funding phase. Each of these disproportionately served small jurisdictions, such as a water district with a handful of IT staff that could never run its own round-the-clock security operations center. When that free federal layer thins, those operators can pay, go without, or lean on the state. California is choosing to make the third option real.

    Two caveats keep this in proportion. The CISA figure is a budget proposal; Congress sets appropriations, and it has advanced bipartisan legislation to keep the grant program authorized. And the state has attached no dollar figure to its own program, so how much of the federal gap it can fill is unknown. The stakes are illustrated by the case federal officials recently flagged in Minnesota: a suspected Iran-linked operation touching more than 30 municipal water utilities in a single campaign, exactly the kind of many-small-targets pattern where limited local defenses matter most.

    What AI-Enabled Defense Means in Practice

    The program names three functions. Vulnerability detection means finding weaknesses, such as unpatched software or exposed services, before attackers do. Network hardening means closing unnecessary openings and tightening configurations. Incident response means containing a breach and restoring service. AI’s promise across all three is speed and scale: sorting thousands of alerts, scanning large inventories of systems, and flagging anomalies faster than a small team could.

    The Governor’s office grounds the urgency in disclosures by leading AI developers that advanced systems independently carried out sophisticated cyber operations in controlled testing, and in adversaries using AI to attack more cheaply and effectively. The logic follows: if the cost of attacking falls, defenders relying on manual processes fall behind, and automation is the natural counter. The announcement does not, however, name the tools, vendors or performance measures the state will use.

    Utilities are also harder to protect than office networks. Water treatment and the power grid run on operational technology, the industrial controllers that open valves, dose chemicals and switch circuits. Much of it is old and cannot be scanned or patched aggressively without risking the very service it runs. Whether the program reaches into those control systems or stays on the business-network side will largely determine how much protection it delivers to the services it names.

    Governance First: An AI Cyber Officer in Every Agency

    The third directive, an AI Cybersecurity Officer in every state agency, creates a named point of accountability across government. It aligns with Cal-Secure 2.0, the state’s 2026 cybersecurity roadmap, which already prioritizes workforce, coordination and wider use of AI-enabled security tools.

    It also completes a two-sided posture. Through Senate Bill 53, signed in 2025, the largest frontier AI developers must publish their safety frameworks and report certain critical safety incidents to the state. With this program, California is both regulating the developers whose models could be misused and deploying AI defensively. The state has not said whether incident reports filed under SB 53 will inform Cal-CSIC’s defensive work, which would be the most direct way to connect the two.

    What It Means for Data Center and Utility Operators

    Data centers, fiber networks and cloud facilities in California depend on the same grid and water systems the program targets, so a compromise upstream is an outage risk downstream. If private operators qualify as critical infrastructure partners, access to state threat intelligence and AI-enabled tooling could be a meaningful resource, particularly for smaller regional providers without large security teams.

    Until eligibility and terms are published, though, prudent planning assumes nothing. Local governments that relied on MS-ISAC’s no-cost services should budget for paid alternatives rather than count on state coverage arriving on a particular date. For security vendors, the program signals state demand for AI-driven detection and response, though procurement details have not been released.

    Background

    California has built out a state cyber apparatus over several years: Cal-CSIC as its threat intelligence and coordination hub, the Cal-Secure statewide cybersecurity roadmap (updated to Cal-Secure 2.0 in 2026), executive orders on artificial intelligence in 2023 and 2026, and SB 53, the Transparency in Frontier Artificial Intelligence Act, signed in 2025.

    Nationally, state and local cyber defense has leaned heavily on federal support: CISA’s field staff, incident response and tools; MS-ISAC’s no-cost monitoring for thousands of governments; and the $1 billion State and Local Cybersecurity Grant Program. All three are now shrinking, changing or facing uncertain funding, which shifts more of the burden to states and the local operators of water, power and communications systems.

    Sources

    Source: Governor Newsom announces new AI cyber defense program to protect California’s critical infrastructure, the Office of the Governor of California’s August 10, 2026 announcement of the AI Cyber Defense Program and related directives.

  • Google’s 55-Bug Test Recasts AI Code Security as a Compute Budget Question

    Google’s 55-Bug Test Recasts AI Code Security as a Compute Budget Question

    TL;DR · 30-second read

    The Short Version

    Google has built an artificial intelligence system trained to find security holes in software, and it is not releasing it to everyone. In one internal test, it found serious flaws in Google’s own systems within two hours, then wrote an attack that worked every time.

    That is why only governments and trusted partners will get it at first, through a limited trial.

    Google’s bet is that many quick, cheap checks can compete with one slow, expensive one. If so, protecting the apps you use could depend partly on how much computing time defenders can afford.

    Google DeepMind announced Gemini 3.5 Flash Cyber on July 21, 2026. The lightweight model is built on Gemini 3.5 Flash and tuned to find, validate and patch software vulnerabilities. It will soon be available through Google’s CodeMender security agent in a limited-access pilot for governments and trusted partners, with access expanding over time.

    Google said the model found 55 unique confirmed issues in the V8 JavaScript engine across a fixed number of invocations, or model calls, compared with 47 for mainline 3.5 Flash and 36 for Anthropic’s Claude Opus 4.6. Separately, Google is bringing CodeMender’s foundational capabilities to customers using generally available Gemini models through its Gemini Enterprise Agent Platform.

    Executive Summary

    Gemini 3.5 Flash Cyber is a specialized version of a smaller, faster model rather than a new flagship. Google positions it as a cost-efficient alternative to large, costly cybersecurity models, arguing that finding deep flaws is a search problem across an enormous number of possible paths through a program’s code. CodeMender calls the model repeatedly, lets sub-agents explore more of those paths, and then consolidates the results into a single report.

    That design matters beyond one product launch. If Google’s results hold up, the practical limit on AI vulnerability discovery shifts toward how many model calls a defender can afford to run, and how often. The announcement offers persuasive signals for that view, but the evidence comes largely from Google’s own testing, and it does not include a price.

    Access is the other major issue. Google describes the architecture as affordable and scalable, yet it is restricting this model because the same abilities that help defenders could also help attackers. Its exploit-writing result shows why that concern is more than theoretical.

    Why the Model-Call Budget Becomes the Constraint

    Google’s central technical argument is that finding vulnerabilities means exploring an immense execution search space, meaning the many routes a program can take as it runs. A single expensive call to a very large model can become a bottleneck. A lighter model can be invoked repeatedly, so that an agent examines more code paths and validates what it finds before producing one report.

    The V8 test illustrates that logic. V8 is the engine that runs JavaScript, and across a fixed number of invocations 3.5 Flash Cyber found 55 unique confirmed issues, against 47 for mainline 3.5 Flash and 36 for Claude Opus 4.6. That is 17% more than the first comparison and about 53% more than the second. Ten of the 55 were missed by both other models, which supports Google’s claim that the tuned model casts a wider net rather than rediscovering the same flaws. Google also says the model keeps finding new code paths and vulnerabilities as invocations increase. If that holds at a useful rate, the number of calls a team can afford directly shapes how much code it can cover.

    This is where security becomes a compute budgeting question. Google pitches the model for frequent scans, time-sensitive launches and commit scanning, which checks code changes as developers submit them. Those uses turn security analysis from an occasional audit into recurring machine workload that grows with a codebase and its pace of change. Security leaders, engineering teams and cloud buyers would need to weigh cost per scan, coverage and speed together. For infrastructure planners, the implied demand profile is many lighter calls rather than fewer heavy ones, although Google has not quantified that demand.

    What the Benchmarks Establish, and What They Leave Open

    The strongest elements are the V8 count and the Chrome production pipeline test. Google says the Chrome vulnerabilities were not publicly disclosed, which reduces the risk that models had already seen the answers in training data. The Big Sleep evaluation also targets hard-to-find flaws in complex codebases including Chrome and Safari, and Google reports that 3.5 Flash Cyber significantly surpassed both mainline 3.5 Flash and 3.6 Flash.

    Each comparison needs careful reading. On CyberGym, a benchmark built around hundreds of real-world software vulnerabilities, the competitive result came from CodeMender calling the model up to five times for one final report, while competitor scores were self-reported by their providers. That is a comparison of differently run systems, not a strictly controlled head-to-head test. Big Sleep is Google’s own team, and those stress tests ran without safety guardrails. Raw counts of unique issues also say nothing by themselves about how severe each issue was or how much each run cost.

    Competitor coverage is limited too. Google says newer competitor versions after Opus 4.6 refused the Chrome tasks because of built-in safety guardrails and so are not shown. The results therefore say little about how Flash Cyber compares with the newest competing models on that test. They do point to a separate buying consideration: a model’s usefulness for security work depends partly on what its safeguards allow it to do, and for whom.

    Affordable in Design, Restricted in Practice

    The clearest illustration of dual-use risk comes from Google’s Cloud Vulnerability Research team. In two hours, Google says, the model uncovered remote code execution flaws, which can let an outsider run commands on a distant machine, in public APIs, and found a memory-corruption flaw in a sensitive production service. It then generated a remote code execution exploit that Google calls 100% reliable and that bypassed two standard defenses: Address Space Layout Randomization, which shuffles where programs sit in memory, and Write XOR Execute, which stops memory from being both writable and executable.

    That capability explains the limited pilot, and restricting it is a reasonable response to the risk. It also creates a practical tension with the announcement’s language about helping more defenders. For now, the specialized model is reserved for governments and trusted partners, while other customers get CodeMender’s foundational capabilities on generally available Gemini models. Those organizations are getting a related offering, not the same one, and Google’s own testing shows the tuned model outperforming mainline Flash models.

    Finding Flaws Faster Does Not Close Them

    Google opens with the concern that AI agents may find vulnerabilities faster than defenders can fix them. A cheaper discovery engine could widen that gap unless remediation scales as well. Each confirmed issue still has to be prioritized, patched, tested and shipped, often by people responsible for systems they cannot change quickly.

    Google says the model is tuned to patch as well as find, and that CodeMender is already finding and fixing vulnerabilities in internal codebases including Chrome, Android, Cloud, Ads and YouTube. The published figures, however, emphasize discovery. For buyers, the more decisive measure may be how many fixes are accepted and deployed, and how much human review they need. A low cost per finding would capture only part of the economics.

    Background

    Google says it has invested in automated vulnerability discovery for years. Its security work includes OSS-Fuzz, an effort with more than 10 years of results; OSV.dev, a database spanning over 700,000 open-source vulnerabilities; the Big Sleep team, which built one of the evaluations used here; and CodeMender, its code security agent. Google says this data helps it train models on real security work rather than synthetic examples, including operating industry-standard tools and reading through millions of lines of code in projects such as Chromium.

    Software vulnerabilities are flaws that attackers can use to crash systems, steal data or take control of machines. Defenders have long relied on automated tools to find them, and AI agents are extending that automation into longer and more complex analysis. Because the same skills can serve both defense and attack, access decisions have become part of how these models are released, as has the question of what safety guardrails allow them to do.

    Sources

    Source: Introducing Gemini 3.5 Flash Cyber – Google DeepMind, Google DeepMind’s July 21, 2026 announcement of its lightweight cybersecurity model and limited-access pilot.