OpenAI Gives Ukraine's Government Access to Daybreak

OpenAI announced on September 23 that it will give the Government of Ukraine access to its Daybreak cyber defense program. Working with Ukraine's Ministry of Digital Transformation, it will open tools that help Ukrainian teams find software vulnerabilities and develop and test fixes more quickly. OpenAI said the program will support the defense of civilian infrastructure such as hospitals, energy and telecommunications.

The announcement was made at a side event of the UN General Assembly in New York. Dmytro Kushneruk, the Consul General of Ukraine in San Francisco, and Sasha Baker, Head of National Security Policy at OpenAI, made it together. According to OpenAI's announcement, Ukraine's national cyber incident response team, CERT-UA, handled nearly 6,000 cyber incidents in 2025 alone, including attacks on hospital systems, the energy sector and telecommunications.

Baker said "Ukraine is already on the front line, and its defenders need support now." George Osborne, Head of OpenAI for Countries, said "protecting civilian infrastructure means defending it against both physical and digital attacks," adding that the work is about letting people continue to live, work and access essential services.

Daybreak opens advanced AI to verified public and private defenders for authorized security work. According to OpenAI's September 3 announcement, Daybreak Blue handles common defensive work with mainline models, while Daybreak Red gives approved organizations specialized cyber models for more sensitive and technically demanding tasks. Approved organizations and workspaces already number 2,000. METAL previously reported that OpenAI that day pledged $1 billion in support for resource-constrained defenders, and at the time the company said it would expand the model to partner countries within weeks. Ukraine is one case of that expansion.

Europe offers precedents. OpenAI said it has already opened its cyber models to defenders in Europe including France, Germany and Poland. The EU's cyber agency ENISA used the models to find vulnerabilities in software used across EU institutions, all of which have since been fixed. Poland's national cyber agency CERT Polska used OpenAI models to help discover six vulnerabilities in third-party router software and confirmed that the vendor's fixes prevent the attacks it observed.

Outside reaction has been broadly welcoming. According to reports, Rafe Pilling, senior director of threat intelligence at security firm Sophos, said "any initiative that strengthens Ukraine's already highly capable, but heavily burdened, cyber defence efforts is a welcome development." Jamie MacColl, a senior research fellow at the Royal United Services Institute, noted that Western tech companies have supported Ukraine not purely out of goodwill but also because they gain valuable data and intelligence from an active conflict, and added that Ukraine already uses AI tools from competitors such as Google.

Through a lawyer's lens, the weight of this announcement lies in dual use. The ability to find vulnerabilities is equally useful to defenders and attackers. According to reports, Anthropic tightly restricts access to its most powerful systems, while OpenAI has let some European companies and UK banks use its most advanced cyber models. The same reporting said Anthropic stated in a report earlier this month that a group of Russian developers appeared to have used Claude, getting around a geographic block, to build drone software for attacks in Ukraine. Opening cyber models to the government of a country at war is both a technology provision and, in effect, a decision about which side to support.

That is why the terms matter. OpenAI's announcement defines Daybreak as being for authorized security work and names civilian infrastructure defense as the scope of this partnership. The announcement, which METAL reviewed, does not state how long access will last, its value, or which models will be opened. According to reports, access is free. How the line between defensive use and offensive operations will be overseen, and by whom, has not been disclosed either.

The conclusion is clear. OpenAI has extended Daybreak from defending U.S. infrastructure, through European institutions, to the government of a country at war. Whether safeguards to confirm the use stays defensive and the terms of use are made public is the next issue.