General-Purpose AI (GPAI) refers to AI systems built to perform many different tasks, rather than a single narrow function. Large language models, multimodal models, and other foundation models are common examples because they can be adapted for writing, coding, search, analysis, or automation. In regulation and governance, GPAI often attracts broader documentation and transparency requirements than task-specific models.
In cyber security, GPAI matters because it expands both capability and risk. Defenders may use it for summarizing alerts, triaging logs, generating detections, or assisting analysts. Attackers can use the same flexibility for phishing, malware development support, social engineering, or rapid content generation. Because GPAI is reused across many environments, security teams need controls for access, logging, prompt and output filtering, model provenance, and change management. If documentation or telemetry is incomplete, it becomes harder to audit misuse, reproduce decisions, or prove compliance.