A GPAI model, or general-purpose AI model, is a foundation model built to perform many different tasks rather than a single narrow job. It can answer questions, summarize text, code, classify content, and support other applications through prompts or downstream fine-tuning. Under the EU AI Act, some GPAI models may carry extra obligations, especially when their scale or capabilities create systemic risk.
In cyber security, GPAI models matter because broad capability also means broad attack surface. The same model may power chatbots, agents, or security tools, so weak access controls, prompt injection, poisoned data, or unsafe tool permissions can turn a simple model error into unauthorized action or data exposure. Defenders reduce this risk with logging, sandboxing, privilege limits, human approval for high-impact actions, and careful testing. Attackers may try to steer the model, extract sensitive information, or abuse connected tools and credentials.