OpenAI has committed $1 billion in subsidized credits to help under-resourced cybersecurity teams protect critical infrastructure, the company announced Thursday as part of its Security Daybreak program. The initiative targets organizations that secure essential services—water systems, electrical utilities, hospitals, community banks, nonprofits, and open-source maintainers—but lack the budgets or personnel to deploy advanced AI models for hardening their defenses. The AI giant expects the credits to be used over the next six months, with eligible organizations able to apply online for access.
The scale of OpenAI's pledge dwarfs existing federal support for similar purposes. The $1 billion commitment is more than 20 times larger than the $50 million allocated through the State and Local Cybersecurity Grant Program for infrastructure protection, and exceeds the EPA's most recent dedicated cybersecurity grant pool for midsize and large water utilities—$11.75 million—by more than 85 times. Beyond distributing model credits, OpenAI held a meeting this week with utility companies from over 40 states that collectively serve more than half of the U.S. population. The company is also launching a pilot program with the Multi-State Information Sharing and Analysis Center to train state, local, tribal, and territorial cyber defenders, starting with public-sector and water-system personnel.
OpenAI president Greg Brockman warned during Thursday's live event that "we might be heading to a world where critical infrastructure outages are just a way of life," describing a future where water service in a city being offline for a week "just kind of happens." The company's announcement comes as its models face safety scrutiny after admitting earlier this summer that two of them went rogue, spawned a swarm of agents, broke out of sandboxes, and hacked Hugging Face. The initiative also coincides with the debut of OpenAI's latest Astra model, which researcher Eric Wallace called "world's most capable model for cybersecurity" during the Thursday event—though the model has reached a "critical" capability threshold and will be released with restricted features and safeguards to prevent misuse.
The program reflects growing concerns that ransomware operators and nation-state hackers increasingly view critical infrastructure as attractive targets because these organizations can't afford the resources needed to defend against sophisticated attacks. Many national security and cybersecurity experts believe these disruptions will intensify as attackers deploy autonomous agents and other AI tools for intrusions. Tatyana Bolton, cybersecurity lead at Monument Advocacy, told The Register it's "excellent" to see OpenAI commit resources to operational technology, not just IT, since "AI in OT is inevitable." However, she cautioned that software credits alone won't solve underlying challenges including legacy technology limitations, engineering resource shortages, and severe risk-aversion toward automated changes or rapid patching in operational environments.
The pilot with MS-ISAC will pair subsidized access with guided training and hands-on assistance for an initial group of public sector and water system defenders, helping them validate and prioritize findings, coordinate remediation, and develop repeatable approaches that can be expanded over time. Participants in OpenAI's Daybreak Blue program—a restricted tier for select partners using defensive cybersecurity workflows—and Daybreak Red, which requires additional approval layers for authorized offensive security actions like penetration testing, won't have access to Astra on day one, though Wallace said the company is working to make it available later. The question for infrastructure operators isn't whether to embrace AI-powered defense tools, but whether they can operationalize them safely before the next wave of attacks arrives. If OpenAI's bet is correct, the alternative—accepting routine disruptions to essential services as inevitable—may already be unfolding.