Democratic governance of frontier AI, part II: Empowering cyber defenders

AI is changing the speed, scale, and economics of cybersecurity. It can help defenders find and fix vulnerabilities, detect intrusions, and respond to attacks—but those same capabilities can enable malicious actors and create new risks when AI systems act beyond their intended boundaries. We are in a defender’s window: a limited opportunity to put advanced AI into defenders’ hands and strengthen protections before advanced cyber offensive capabilities become widely available.

Today, we’re publishing a blueprint for empowering cyber defenders, building on our earlier cybersecurity action plan and frontier safety blueprint ⁠ (opens in a new window) . Our experience with misalignment and security incidents involving our own models underscores the need for stronger safeguards and accountability across the industry. Drawing on those lessons, the blueprint puts forward concrete proposals for governments and industry in three areas:

- Strengthening safety and security for advanced AI: Establish clearer responsibilities for securing frontier models and agents, detecting dangerous behavior, and maintaining reliable shutdown controls for operations under each organization’s control.

- Modernizing cybersecurity for the intelligence age: Equip defenders with advanced tools, training, and technical support; address longstanding cybersecurity weaknesses; and invest in securing essential services and replacing outdated systems.

- Building resilient and adaptive public institutions: Strengthen government evaluations and independent technical assessments, establish consistent incident reporting requirements, and improve coordinated response and recovery.

AI labs have a responsibility to address the risks their systems create and help strengthen society’s defenses. Governments must also have the expertise, resources, and authority to protect the public as capabilities advance. We encourage policymakers to act now—establishing safeguards, learning from experience, and strengthening requirements as the technology evolves.