OpenAI said on 23 September that it is extending access to its Daybreak program to the Government of Ukraine to support the cyber defence of civilian infrastructure. The announcement was made during the UN General Assembly, and OpenAI is working with Ukraine’s Ministry of Digital Transformation.
Daybreak gives cyber defenders model access for authorised security work: reviewing legacy software, investigating suspicious activity, validating vulnerabilities and developing and testing fixes. Ukraine’s teams get it free, along with OpenAI’s cyber-focused model — identified as GPT-5.6 Sol in The Next Web’s account of the announcement.
Why this is different from the previous deployments
Daybreak was built for critical infrastructure operators, and has been running with defenders in France, Germany and Poland. The Next Web reports that Poland’s CERT Polska used OpenAI models to identify six flaws in router software.
Ukraine is a different kind of user. It is a government defending civilian systems during a war, against an adversary with state resources and a demonstrated willingness to hit power, hospitals and telecommunications. Ukraine’s national incident response team, CERT-UA, handled close to 6,000 incidents in 2025, including attacks on hospital systems, the energy sector and telecoms, according to figures cited in the reporting.
That changes what the deployment is. In France or Germany, Daybreak is a productivity tool for a security team. In Ukraine it is being handed to a party in an armed conflict, for use on infrastructure that is an active target.
The line OpenAI is drawing
The framing is explicitly defensive and explicitly civilian: infrastructure, not operations. “Ukraine is already on the front line, and its defenders need support now,” Sasha Baker, OpenAI’s head of national security policy, said. George Osborne, who leads OpenAI’s work with countries, said protecting civilian infrastructure means defending it against both physical and digital attacks.
That line matters because the same capability — find the flaw, write the exploit path, test the fix — does not care which direction it points. The distinction between defending a grid and mapping someone else’s is a matter of policy, monitoring and trust, not of what the model can do.
What to watch
Whether OpenAI publishes any account of how the Ukrainian deployment is monitored, and whether other governments at war ask for the same access. The first request from a state OpenAI is less comfortable supplying is where this policy gets tested, and nothing in the announcement says how that call will be made.
