OpenAI Braces for AI Models That Could Breach Defenses

OpenAI said Wednesday it is preparing for artificial intelligence models to reach “high” cybersecurity risk levels, marking an escalation in the dual-use capabilities that could strengthen defenses or enable sophisticated attacks.

See Also: Agentic AI and the Future of Automated Threats

The ChatGPT maker said it is planning and evaluating as though each new model could achieve capabilities sufficient to develop working zero-day remote exploits against well-defended systems or meaningfully assist with complex, stealthy enterprise or industrial intrusion operations aimed at real-world effects. The warning comes as the company’s cyber capabilities have advanced dramatically in recent months, with performance on capture-the-flag challenges jumping from 27% on GPT-5 in August to 76% on GPT-5.1-Codex-Max in November.

The company expects upcoming models to continue on this trajectory, though it did not specify when the first models rated high for cybersecurity risk would arrive or which types of future models could pose such risks. High represents the second-highest risk level in OpenAI’s Preparedness Framework, below the critical threshold at which models are deemed unsafe for public release.

OpenAI researcher Fouad Matin reportedly pointed to a specific capability driving the concerns. “What I would explicitly call out as the forcing function for this is the model’s ability to work for extended periods of time,” Matin told Axios, referring to the potential for brute force attacks that rely on sustained autonomous operation.

The company issued a similar warning about bioweapons risk in June, followed by the July release of ChatGPT Agent, which did rate high on its risk levels. Like other dual-use domains, defensive and offensive cyber workflows often rely on the same underlying knowledge and techniques.

Allan Liska, threat intelligence analyst at Recorded Future, offered a cautious perspective. “While it is true that the security risks from AI models are continuing to grow both because of their capabilities and the stepped attacks against the guardrails these models have in place, it’s also important to not overhype the threats,” he said in an email.

“We’ve already seen a couple of reports this year that exaggerated the threats that AI models currently pose. While we have reported an uptick in interest and capabilities of both nation state and cybercriminal threat actors when it comes to AI usage, these threats do not exceed the ability of organizations following best security practices,” he said.

OpenAI said it is investing in strengthening its models for defensive cybersecurity tasks and creating tools that enable defenders to more easily perform workflows such as auditing code and patching vulnerabilities. The company framed its goal as bringing significant advantages for defenders, who are often “outnumbered and under-resourced,” while limiting uplift for malicious purposes.

The company is training its frontier models to refuse or safely respond to requests that would enable clear cyber abuse while being helpful for legitimate defensive and educational use cases. OpenAI said it is implementing a combination of access controls, infrastructure hardening, egress controls and monitoring, complemented by detection and response systems and dedicated threat intelligence and insider risk programs.

OpenAI said it will introduce a trusted access program exploring tiered access to enhanced capabilities in its latest models for qualifying users and customers working on cyber defense. The company said it is still determining which capabilities can receive broad access and which require tiered restrictions, factors that may influence the program’s future design.

The company is also establishing the Frontier Risk Council, an advisory group that will bring experienced cyber defenders and security practitioners into close collaboration with OpenAI’s teams. The council will start with a focus on cybersecurity and expand into other frontier capability domains in the future. Its members will advise on the boundary between useful, responsible capability and potential misuse, with findings directly informing evaluations and safeguards.

Aardvark, OpenAI’s agentic security researcher that helps developers and security teams find and fix vulnerabilities at scale, is now in private beta. The tool scans codebases for vulnerabilities and proposes patches that maintainers can adopt quickly. It has already identified novel CVEs in open-source software by reasoning over entire codebases. OpenAI plans to offer free coverage to select non-commercial open source repositories to contribute to the security of the open-source software ecosystem and supply chain.