Systemic-risk GPAI means a general-purpose AI model whose scale, capability, or deployment could create broad security, safety, or societal harm. The risk is not just whether the model can answer questions well, but whether it can be misused across many users, tools, and environments.
In cyber security, this matters because a powerful model may help with phishing, malware adaptation, social engineering, or automated decision-making at large scale. It can also increase defensive exposure: if the model is connected to browsers, APIs, or internal systems, prompt injection, tool abuse, or poor access controls can turn a language model into an attack path. Defenses focus on evaluation, monitoring, incident reporting, and strict permissions before deployment. Under regulatory frameworks such as the EU AI Act, systemic-risk GPAI is treated as needing extra governance because failures can propagate beyond a single application.