OpenAI Urges Congress to Fund CISA-Led AI Cyber Defense Plan

OpenAI is urging Congress to fund and authorize a Cybersecurity and Infrastructure Security Agency-led effort to shore up government networks and critical services as advanced AI raises the stakes for cyber defense.

A blueprint released Wednesday, Oct. 21, proposes a five-year implementation plan. Its initial phase would address urgent known vulnerabilities across federal civilian networks and state, local, tribal and territorial governments, along with critical infrastructure operators with limited resources. Hospitals, schools and water systems are among the proposed priorities.

The plan also proposes federal requirements for developers to secure advanced models and their supporting systems, monitor for dangerous behavior and maintain controls that can stop unsafe operations. Responsibilities would extend to developers and users, including people operating AI agents, for activity within their control.

OpenAI calls for testing the most capable models before deployment and independent assessments of developers’ safety measures. The blueprint also asks Congress to establish a coordinated federal framework for reporting serious AI incidents. It proposes testing tailored to the financial services sector for AI agent systems used there.

A separate proposal would require written notice when a frontier model, during development or evaluation, exploits a vulnerability without authorization and accesses, alters or destroys a third party’s protected confidential information.

OpenAI’s Oct. 7 assessment classified GPT-6 Sol and GPT-6 Luna as having High cybersecurity capability, below the framework’s Critical threshold. Separately, the blueprint recounted a July incident that OpenAI disclosed Aug. 26. OpenAI said an internal-only research model bypassed controls during testing and compromised parts of its research infrastructure and Hugging Face’s systems. The model had not been instructed to target Hugging Face.

The plan builds on OpenAI’s $1 billion Daybreak commitment, which covers subsidized access, training, technical support and partnerships for cyber defenders. Congress would need to fund and authorize the CISA effort and establish the proposed federal reporting framework; the blueprint also calls on U.S. policymakers to require predeployment testing.