NASK, the Polish state research institute that runs the country’s .pl domain registry, spends its working hours watching for the traffic that precedes an attack: a sudden run of lookups against a bank’s login page, a wave of messages from a spoofed ministry address, a domain registered three days ago and already sending invoices. On Friday it added a partner on the other side of the Atlantic.
OpenAI said it signed a cooperation agreement with NASK covering AI security and the protection of cyberspace. The two organizations will exchange methods for assessing model risk and carry out joint research, according to a statement from the company. Financial terms were not disclosed, and neither side published the text of the agreement.
The deal is the latest in a run of government-level arrangements OpenAI has struck in Europe. Over the past year the company has been converting regulatory scrutiny into working relationships, signing with national ministries, defense-adjacent agencies and public research bodies as European capitals debate how much of their computing and intelligence infrastructure should depend on American vendors.
That debate has sharpened. European officials have spent the autumn arguing over dependence on United States technology after restrictions were placed on satellite communications services used by Ukrainian forces, and after questions were raised in Brussels about how much control a foreign vendor retains over military software it supplies to NATO. Palantir’s executive vice president for Britain and Europe, Louis Mosley, said this week that neither his company nor the United States government can switch off the Maven system used by the alliance, and that customers keep full operational control. The fact that such a statement was needed tells you where the anxiety sits.
NASK is an unusual counterpart for a model developer. Created as an academic networking body, it now operates the registry for Poland’s country-code domain, which gives it a view of the domain space that few organizations have, and it hosts CERT Polska, the national computer emergency response team that handles incident reports from banks, hospitals and municipal governments. Its researchers publish on botnets, phishing infrastructure and the abuse of legitimate services. Domain registries sit at a useful vantage point: ahead of the attack, in the registration data.
What the two sides will actually do is narrower than the headline. Sharing methods for assessing model risk means exchanging the tests each side uses to probe a model for harmful capability, for susceptibility to manipulation, and for the ways a system can be talked into assisting with cyber intrusion. Joint research usually means shared staff time, published papers where publication is permitted, and a channel for raising alarms when one side finds something the other should know about.
The unresolved question in these arrangements is always the same: what happens when the research points at the vendor’s own product. A government partner that depends on a company’s models has an incentive to be diplomatic about their weaknesses, and an institute whose funding comes partly from the state has an incentive to be diplomatic about its own findings. Neither incentive is corruption. Both shape what gets published.
Poland brings its own weight to the arrangement. The country held the European Union’s rotating presidency in the first half of 2025 and has been one of the louder voices arguing that the bloc needs to treat cyber defense as infrastructure rather than as a procurement category. Polish officials have also been among the more enthusiastic buyers of American cloud and AI services in central Europe, which puts them in the awkward position of arguing for European sovereignty while signing with American suppliers.
For OpenAI, the strategic value is straightforward. Governments are slow buyers, but they buy for years, and they bring with them the classification regimes, audit requirements and data-location rules that make a vendor credible with banks and utilities. The company has been building a public-sector business that runs alongside its consumer products, and each national agreement makes the next one easier to argue for. Anthropic and Microsoft have been pursuing the same buyers with the same pitch.
European alternatives make the opposite case. Mistral, the French model developer, has built much of its government business on the argument that ministries handling classified material should not send it to a vendor subject to another country’s legal process. That argument has found listeners in Paris and Berlin. Warsaw has been less absolutist, preferring to buy capability quickly and negotiate the safeguards afterward.
There are practical tests ahead. The first is whether the cooperation produces anything a skeptical procurement officer can read: an evaluation framework, a threat report, a documented method that other agencies adopt. The second is whether NASK’s incident responders end up using OpenAI’s models in live cases, which would make the relationship operational rather than ceremonial. The third is whether other governments in the region follow Warsaw, as they often have on security matters.
OpenAI said the agreement covers safety and cyber defense without elaborating on either. A person familiar with the discussions described the first phase as exploratory, with work plans to be set by technical teams rather than executives. That is how most of these agreements begin. The ones that matter are the ones where the work plan survives the second year, when the press release is forgotten and the budget line has to be defended.
