OpenAI signs an AI safety research deal with Poland's NASK, the home of CERT Polska

What OpenAI and NASK announced

OpenAI and NASK, Poland's National Research Institute, have signed an agreement "to explore collaboration on AI safety, security and technical research", according to an OpenAI post dated 23 October 2026. The work will run through NASK's AI Safety Research Center, which OpenAI says serves as Poland's Artificial Intelligence Safety Institute, the national body that studies the risks of advanced AI.

OpenAI says the two organisations will look at ways to evaluate increasingly capable AI systems, find potential weaknesses and strengthen safeguards. The announcement did not include a budget, a term, a list of projects or any commitment about which OpenAI models NASK will get to test, and it describes the deal as a starting point for collaboration rather than a fixed programme.

Radoslaw Nielek, NASK's director, called the deal "a natural step" for the institute. He said its AI safety work covers safeguards against emerging risks, detecting AI-generated content, understanding malicious uses and "the multilingual aspects of these challenges", adding that "AI safety cannot be achieved in isolation". Tom Duff Gordon, OpenAI's vice-president and head of policy for Europe, the Middle East and Africa, said Poland has exceptional technical talent, "many of whom have helped lead OpenAI's own research", and that OpenAI needs outside experts "to challenge our assumptions, test our systems and strengthen safeguards".

Who NASK is

NASK is a state research institute that runs much of Poland's internet security infrastructure. It operates CERT Polska, the national computer emergency response team, and the .pl domain registry, and it is one of the bodies that handle cyber incidents under Polish law. That operational role is what sets it apart from many AI safety institutes, which tend to be pure research or policy units.

Its AI Safety Research Center was formed by converting NASK's artificial intelligence division, according to a Polish digital affairs ministry announcement. It is headed by Szymon Lukasik, a professor at AGH University of Krakow, and includes departments for audiovisual analysis and biometrics, language engineering and text analysis, data science, AI in medicine, and a department focused on the safety and transparency of AI models. The ministry says the center works with AGH, Warsaw University of Technology and the IDEAS institute.

In practice, that gives NASK expertise in areas OpenAI singled out: spotting synthetic content and deepfakes, handling languages other than English, and protecting public services and Poland's information space from misuse of AI.

What the agreement covers, and what it does not

On paper, the agreement covers joint research on evaluations, vulnerabilities and safeguards. OpenAI frames it as part of a broader push for international technical standards for frontier AI: common ways to evaluate capabilities, assess risks, test safeguards and report incidents, so countries can compare evidence and respond to risks that cross borders. OpenAI says that "without national partners like NASK, global AI safety standards may remain detached from the realities in which AI is actually used".

What the post does not say is just as important. It does not describe pre-release access to new models, which is the main thing the US and UK institutes get from frontier developers. It does not mention money flowing in either direction, publication rules for findings, or how disagreements over results would be handled. Those details may exist in the signed text, but neither organisation has published it, so the scope beyond the headline should be treated as unknown.

The MikroTik case that came first

The agreement builds on a concrete case. OpenAI says CERT Polska got access to its cyber-capable models in July, and used them to help find six vulnerabilities in MikroTik RouterOS, the operating system on MikroTik routers that are common in small networks and internet providers. CERT Polska's advisory from September says combining two of the flaws let an attacker take full control of a device without authentication if its SSH remote-access service was reachable. CERT Polska named the chain MikroTrick.

The flaws were not theoretical. CERT Polska said it had observed attacks against internet-facing RouterOS devices and confirmed that attackers were using the combination to take over routers with SSH open to public networks. It also confirmed that MikroTik's patches stopped the attacks it saw. MikroTik, for the first time, sent a push notification to users of its mobile app urging them to update.

MikroTik's security bulletin, updated on 6 October, lists all six CVEs. The SSH flaws, including CVE-2026-67279, the one exploited in the wild, CVE-2026-86060, a crafted-username privilege escalation, and CVE-2026-67276, a public-key authentication bypass, are fixed in RouterOS 7.24.2, 7.23.4 and 6.49.21. A WebFig flaw allowed unauthenticated file reads on RouterOS 7.20 and later. The certificate issue, CVE-2026-67278, needed a second patch: MikroTik says the complete fix is in 7.24.3 and 7.23.6, so anyone who updated in September should update again. Routers on 7.24.3, 7.23.6, 6.49.21 or later have all six fixed.

How CERT Polska used the models

CERT Polska's technical write-up is unusually specific about how AI was used. The team says the research was done with GPT-5.5-cyber and GPT-5.6-sol models with reduced refusal thresholds, available through OpenAI's Government and Trust Agency Collaboration (GTAC) programme. OpenAI's own post describes the access as coming through Daybreak, its cyber-defence offering. CERT Polska also runs open-weight models locally, including GLM, DeepSeek, Qwen and the Polish model PLLuM.

The key, according to the write-up, was an isolated lab in which an agent could control virtual machines on its own. Through libvirt, the agent built and restored machines, ran tests and collected results. By the end, the lab held 40 virtual routers, 39 snapshots and 24 RouterOS releases from 6.43.11 to 7.25beta3. The agent analysed router binaries with radare2 and Ghidra, compared them against protocol specifications, and modelled protocols as state machines to see what happened when a step was skipped, repeated or done out of order.

Humans stayed in charge. The researchers chose the areas to search, defined the scope of each experiment and only counted a vulnerability as confirmed after repeatable results, negative tests and checks across several RouterOS versions. They said the slowest parts were preparing precise context for the agent, resolving ambiguous results and validating findings. After the patches shipped, agents also watched the MikroTik forum, Reddit and other public sources for signs of exploitation. Using administrator logs and patch diffing, the team identified one new critical flaw, CVE-2026-86060, within an hour.

That pattern, models doing the repetitive lab work while specialists direct and verify, matches what AI Lookout has seen elsewhere, such as the PHP flaws that AI helped researchers find and exploit and Sophos's use of OpenAI's Daybreak models for managed detection.

Where this fits among AI safety institutes

OpenAI cites its existing work with the US Center for Advancing Standards and Innovation for Super Intelligence (CAISSI) and the UK AI Security Institute. The UK institute has been the most active of these bodies; AI Lookout covered its eight priorities for technical best practice in frontier AI and the government's wider AI risk package and AISI incident reporting earlier this month.

Poland is a smaller player, but the NASK deal adds two things the larger institutes do not emphasise. One is language: models that are safe in English can behave differently in Polish or other less-resourced languages, and NASK has worked on Polish models through the PLLuM project. The other is operations: CERT Polska handles real incidents, so its evaluations can be tested against attacks that are actually happening.

For OpenAI, agreements like this also have a policy angle. The company says it has called on the US to work with other countries on common technical standards. Partnerships with national institutes in Europe give it allies in those discussions, while the institutes gain hands-on access to frontier systems they could not build themselves.

Questions the announcement leaves open

The biggest open question is access. Will NASK test OpenAI models before release, after release, or only through the cyber programmes it already uses? A second is independence: if NASK finds problems, can it publish them on its own schedule? A third is reach: whether the agreement is a template for other EU countries, and how it relates to the EU AI Act's rules for general-purpose AI models, which neither side mentioned.

There is also the dual-use issue the MikroTik case shows. Models with lowered refusal thresholds helped defenders find a flaw that attackers were already exploiting. The same capability in the wrong hands would help attackers too, which is exactly why government evaluators want to study these systems closely.

What to watch next

Look for NASK to publish its first joint evaluations or research results, and for details on whether the deal includes pre-deployment testing. Network administrators, meanwhile, have a more immediate task: if you run MikroTik routers, make sure they are on RouterOS 7.24.3, 7.23.6, 6.49.21 or later, keep SSH and WebFig closed to untrusted networks, and check for unknown users, scripts and scheduled tasks, as MikroTik and CERT Polska advise.