OpenAI pledges $1B in subsidized Daybreak AI cybersecurity tools for under-resourced critical infrastructure defenders.

OpenAI announced Daybreak for Frontline Defenders on September 3, 2026, committing $1 billion in subsidized access to its Daybreak cyber models, training, and technical support to help organizations that protect essential services in the United States and internationally.

“A $1 billion global commitment to expand subsidized access to Daybreak cyber models and products, training, technical support, and partnerships in the United States and internationally.” reads the announcement

The full announcement is at openai.com. The $1 billion is product credits and subsidized access, not a cash grant, targeted to be used over the next six months.

“Every day, we depend on cyber defenders to protect the systems that keep communities running: the water coming from the tap, the electricity powering homes and businesses, the local government systems that deliver public services, and the financial institutions people trust with their money.” continues the announcement. “Many operate with limited staff and budgets, while defending complex and aging systems.”

Priority access goes to water and wastewater utilities, electric grid operators, state and local governments, community and regional banks, nonprofits, and open-source maintainers. These are the organizations defending complex, often outdated infrastructure against faster-moving threats without the budgets or specialized staff available to large enterprises.

Daybreak has been running since June 2026, and OpenAI expanded it in August with the release of GPT-5.6-Cyber. The program has two levels: Daybreak Blue supports common defensive tasks with standard models, while Daybreak Red gives approved organizations access to specialized cyber models for more sensitive and advanced work.

Around 2,000 organizations and workspaces already use Daybreak, including cybersecurity companies, defense groups, and law enforcement agencies. OpenAI’s new $1 billion commitment aims to give the same capabilities to defenders with limited resources who can’t afford commercial pricing.

“In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. That shift puts every organization on notice. Defenders need to act now: test systems, find weaknesses, and strengthen defenses before attackers do.” states OpenAI. “Frontier AI can help defenders move faster. We have a defender’s window: a narrowing opportunity to use AI to close security gaps before attackers seize them. Our role is to help put powerful tools in defenders’ hands so they can protect the systems, and the people, they are responsible for.”

OpenAI made this announcement the same day it shipped a model it classifies internally as meeting the “Critical” threshold for cyber capability, meaning it can meaningfully help someone trying to create cyberweapons. The timing underscores the tension the company is navigating: it’s building tools capable of both attack and defense, and is publicly betting that putting the defensive version in more hands faster is the right move.

The initiative includes a pilot with MS-ISAC, a federally supported organization that shares threat intelligence and incident response support with thousands of public-sector organizations, including utilities, hospitals, schools and law enforcement agencies. The pilot will give an initial group of public-sector and water-system defenders access to Daybreak, along with training and hands-on support.

OpenAI has already tested this approach after recent attacks on U.S. water infrastructure. The company offered affected states and utilities up to $1 million in free API credits and Daybreak access. Teams used the tools to review code and configurations, verify security findings, develop patches and test fixes while keeping water systems running. The new initiative aims to expand this model to more defenders.

The Daybreak Defense Network, also announced September 3, brings more than 35 enterprise products and partner-operated services into the Daybreak ecosystem. HackerOne is among the early partners. The goal is to make Daybreak capabilities available through tools defenders already use rather than requiring them to switch workflows. SecurityWeek notes that OpenAI has disclosed few details about costs and eligibility for the broader program, which matters considerably for a rural water utility or county government trying to determine whether they qualify.

OpenAI also published its Defense Factory architecture, a continuous automated system that finds vulnerabilities, tests them and prepares fixes for human review. The company is sharing the architecture so other defenders can adapt it to their own environments.

The announcement came with support from more than 150 organizations across cybersecurity, technology, critical infrastructure, finance and AI. OpenAI presented the initiative as a joint effort rather than a project led by the company alone.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Astra)

CISA urges water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised.

Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next. The agency’s exposure reduction guidance, published August 21, walks through exactly how organizations can find their own internet-facing weak points before an attacker does.

The pattern behind the July attacks was surprisingly simple. Most of the affected systems were programmable logic controllers (PLCs), small industrial computers that control pumps and valves. Many connected directly to cellular modems and had no firewall or gateway between them and the internet. CISA warns that this type of setup can expose PLCs to serious security risks.

“Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.” states CISA.

Hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating what CISA called unsafe conditions without notifying the operators running the actual equipment. Iran is the suspected actor behind much of this activity, likely tied to the ongoing war involving the US and Israel, though officials have stopped short of a formal attribution.

CISA presents reconnaissance as an ongoing process. Organizations need to know which systems they expose to the internet and can use tools such as Shodan, Censys, or CISA’s Cyber Hygiene Vulnerability Scanning service to check their own IP ranges from the outside.

The review should also cover ports used by industrial systems. Besides SSH, RDP, and HTTP, CISA highlights protocols such as Modbus, EtherNet/IP, DNP3, BACnet, and OPC UA. Finding one of these ports open does not automatically mean the system has been compromised, but it does indicate an exposure that needs to be investigated and addressed quickly.

Where remote access is genuinely necessary, CISA’s advice is to route everything through a secure, centrally managed gateway rather than connecting straight to a PLC, HMI, or remote terminal unit. Pair that with phishing-resistant multi-factor authentication, unique credentials instead of shared defaults, and active monitoring of traffic in and out, and you’ve closed most of the gap that let this particular wave of attacks succeed in the first place. None of this is exotic security engineering; it’s the same basic hygiene that’s been recommended for years, just finally getting attention because attackers are actually using the gap.

This isn’t an isolated incident CISA is responding to reactively, either. The water sector attacks sit inside a much larger pattern of nation-state interest in US and allied critical infrastructure, from China’s Volt Typhoon reportedly pre-positioning malware inside American infrastructure as a potential wartime disruption tool, to Russian-linked campaigns testing water and energy systems across Europe as part of broader pressure on NATO. If a foreign government is willing to spend years quietly waiting inside a power grid, an exposed PLC with a factory-default password isn’t a minor oversight, it’s an open invitation.

“CISA urges all critical infrastructure organizations to route all necessary remote access through a secure gateway, firewall, VPN, or other centrally managed access solution, rather than connecting directly to a PLC, human-machine interface (HMI), or remote terminal unit (RTU).” concludes CISA. “The July 2026 malicious cyber activity targeting WWS Sector entities demonstrates the consequences of directly exposing PLCs to the internet. Threat actors remotely accessed internet-exposed PLCs, changed device IP addresses and passwords, and caused loss of monitoring and control functionality and, in some cases, operational disruptions.”

If you run anything with the letters PLC, SCADA, ICS, or HMI in its job description, this guidance isn’t optional reading for next quarter. Go run the scan today, because the alternative is finding out the hard way that someone else already ran it for you.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Water Utilities)

Iran-linked hackers targeted Water Infrastructure in New Jersey and Alabama, bringing confirmed attacks to at least 12 states, with limited disruption.

The wave of cyberattacks targeting US water infrastructure has reached New Jersey and Alabama, bringing the confirmed count to at least 12 states since late July. The attacks are linked to Iranian hackers targeting industrial control systems made by Rockwell Automation and potentially other major vendors. Minnesota was the first to confirm over 30 affected water systems, followed by Michigan, South Dakota, and Georgia, and now two more states.

“The City of Cape May Sewer Department and the Borough of Woodbine Water Department reported the attacks on Thursday. Officials said the attacks happened nearly simultaneously early in the morning on July 27.” reports Fox29 “Both systems were impacted for approximately 12 hours.”

Water kept running in both New Jersey districts throughout the incident, and tests afterward confirmed no impact on water quality or safety. Cape May city manager Paul Dietrich told Fox29 that hackers changed settings to prevent remote access to the system, but did not take control of the systems to do anything — which is a meaningful distinction, and not the kind anyone wants to be making about their water supply.

“Cybersecurity experts say hackers could control a lot after breaking into a local water system. ‘They’re actually having the ability to control the water pressure, meaning that they could increase the pressure and cause flooding, or they could decrease the pressure so that you would have a reduced pressure, or ultimately, have no water flow at all,’ said Ian Marlow, CEO of FITECH.” continues Fox29.

In Alabama, the Childersburg Water, Sewer and Gas system was hit the same day, July 27, with hackers targeting industrial control systems. The attack didn’t disrupt water services there either. Neither department’s customer data was accessed in New Jersey, and no significant service disruption was reported in Alabama.

“The Childersburg Water, Sewer, and Gas Board reported that its computerized monitoring and control network was targeted in a cyberattack late last month, prompting officials to temporarily disconnect the system while additional safeguards are put in place.” reports Sylacauga News. “According to the utility, the incident occurred on Monday, July 27 and involved a programmable logic controller, a type of industrial device used to help manage utility operations. Officials said the attack was part of a broader effort that also targeted several other public utilities.”

The pattern across all confirmed states is consistent: attacks targeted operational technology and industrial control systems, some facilities shut down systems as a precaution, disruptions were limited, and drinking water remained safe in every case. The FBI confirmed at least seven states had been targeted as of July 30. Wisconsin, Pennsylvania, and Washington have issued warnings to water utilities without confirming attacks. New York has not said whether its utilities were hit but announced more than $9 million in grants to strengthen water sector cybersecurity.

The practical lesson from every confirmed case so far is the same one CISA has been repeating since its July 30 alert: get PLCs and industrial control systems off direct internet exposure, because the attackers are scanning for exactly that exposure and finding it.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Water Infrastructure)

Coordinated OT cyberattacks hit 30+ Minnesota water utilities, briefly disrupting one plant. Backup procedures prevented major water service impacts.

Minnesota just had its own live-fire lesson in what happens when someone targets water utilities at scale. Between Sunday and Monday, July 26 and 27, a coordinated cyberattack hit operational technology (OT) systems at more than 30 community water utilities across the state, according to Minnesota IT Services (MNIT).

“A coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems on July 26 and 27. Minnesota IT Services (MNIT) immediately activated the state’s cybersecurity incident response capabilities.” reads the statement published by MNIT. “MNIT continues to collaborate with federal, state, local, Tribal, and private-sector partners to investigate the attack, support affected communities, and strengthen the security of Minnesota’s critical infrastructure.”

The agency activated its statewide incident response the moment it learned of the attack, and it’s still active as of this week.

Four cities went public with details: Braham, Maple Plain, Plymouth, and South St. Paul. Braham took the hardest hit of the group; the town of about 1,700 people had its water plant knocked offline entirely after attackers disabled the computerized controls running its well and treatment systems.

Crews had the plant back up within roughly two hours, filtering and treating water normally again.

Plymouth got off comparatively easy. The city’s IT team disconnected the cellular-connected equipment at two of its water towers as a precaution, and the issue stayed contained to that cellular-connected equipment, according to the city’s own statement. Most of the affected utilities across the state kept running through backup procedures without ever going offline.

Minnesota IT Services is continuing to investigate the coordinated cyberattack against the state’s water utilities while helping affected operators contain the incident, assess the damage, and restore impacted systems. The agency is sharing threat intelligence and response guidance in coordination with state and federal partners, including the FBI, CISA, the EPA, the Minnesota Department of Health, and local utilities. Authorities are still analyzing the scope of the attack, but there is currently no indication that drinking water safety has been compromised, and no Minnesota community has been advised to change its water use.

MNIT’s chief information security officer, John Israel, put out a statement framing the response as proof the state’s investment in cybersecurity partnerships actually paid off.

“Cyberattacks against critical infrastructure require a coordinated, whole-of-government response,” said Israel. “MNIT is working side by side with our partners to share intelligence, support affected communities, and help utilities restore operations safely while strengthening defenses against future attacks. This incident demonstrates why Minnesota has invested in strong cybersecurity capabilities and partnerships. Our response worked as intended, enabling agencies at every level of government to rapidly coordinate, contain the incident, and help prevent more serious impacts to critical services.”

Partners include a mix of state, local, federal, and Tribal entities now working the case together. That list includes Minnesota’s Department of Health, its Bureau of Criminal Apprehension fusion center, CISA, the EPA, and the FBI, all working alongside the affected utilities directly.

The attack has yet to be attributed, and the investigation is still ongoing. The timing lines up close enough with something else to raise an eyebrow, though: four days earlier, CISA and six other federal agencies had updated a warning about Iranian-affiliated hackers exploiting internet-facing programmable logic controllers made by Rockwell Automation, Schneider Electric, and Siemens, across US water and energy infrastructure broadly. Nobody’s confirmed a link between that advisory and what happened in Minnesota, and it would be premature to draw a straight line between the two just because they landed in the same week.

Minnesota’s health department says it hasn’t seen any city ask residents to change how they use their tap water, which is the detail worth holding onto here. Contingency plans, backup procedures, and manual overrides did what they’re supposed to do at a majority of the affected utilities: nothing dramatic happened, because the boring stuff worked. Sometimes the best cybersecurity story is the one where nobody outside the IT department even noticed.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, water utilities)