OpenAI hires former Army Secretary Dan Driscoll as open source security concerns mount

OpenAI announced the hire on 3 November, CNBC reported. Driscoll's updated LinkedIn profile lists the position. The role, senior counselor for national security modernization, is new at the company. According to CNBC, Driscoll will advise OpenAI leadership on AI in national security and cybersecurity. He will also work with outside partners to help U.S. allies adopt advanced AI.

The timing is not accidental.

The same week, the chief executive of a major cybersecurity vendor told CNBC that AI is making attacks cheaper and faster. The UK's National Cyber Security Centre warned that AI-powered attacks on critical infrastructure are likely within two years. OpenAI is positioning itself as a partner to governments, not a bystander in that debate. The hire gives that positioning a face.

Why an Army secretary, and why now

Driscoll is an Iraq war veteran who pushed efforts to modernize the U.S. military, according to a previous U.S. Army announcement cited by CNBC. Those efforts included expanding access to drone and counter-drone technologies among U.S. allies. He also met Ukrainian President Volodymyr Zelenskyy in Kyiv in November 2025 to discuss a U.S.-proposed peace plan, according to a statement from the Presidential Office of Ukraine.

He resigned as Army secretary earlier this year after reported tensions with Defense Secretary Pete Hegseth, Reuters reported. In a statement carried by CNBC, Driscoll said national security requirements are changing faster than at any time in the past fifty years. He said AI could help reduce paperwork, process information and deliver answers more quickly. OpenAI CEO Sam Altman said the U.S. has an extraordinary opportunity to work with other countries to spread the adoption of democratic AI.

The hire lands in a crowded policy field.

On 2 November, Tom's Hardware reported that OpenAI is preparing a public relations campaign ahead of the 2028 presidential race, according to Axios. The report included a proposal to rename its data centers "AI Compute Campuses." The same report quoted OpenAI's chief global affairs officer, Chris Lehane, saying the midterms would be "a bit of a movie trailer for what you're going to see in 2028." That is a company already thinking about how politicians will frame AI regulation. A former Army secretary gives it a credible voice in the security argument.

The open source gap that AI keeps exposing

The security debate has a less glamorous side, and most of the recent evidence sits there. In October, the Citizen Lab documented how the ad-tech firm Discover-Tech used its Controlium platform to fingerprint and infect devices the moment an advertisement was rendered. The platform delivered Candiru spyware with no click required, according to the Zero Breach project on GitHub. That project draws its indicator set from that reporting and from Recorded Future's independent tracking of the same infrastructure. At least 45 devices at Al Jazeera were targeted across 2024 and 2025, the project says.

The Zero Breach toolkit, released on GitHub, is a local, read-only scanner. It checks a machine for traces of that campaign.

Its authors are careful about what it can prove. A clean result is not a clean bill of health, they write. Spyware of this grade is built to defeat exactly this kind of check, and most of the evidence it leaves expires within weeks. The tool narrows uncertainty; it does not remove it. That honesty is rare in security tooling and worth noting.

The same pattern shows up throughout: AI finds or exploits weaknesses faster than humans can respond. The open source supply chain is the pressure point. A PHP vulnerability in late October raised concerns about internet infrastructure. Reporting notes that the foundation behind PHP's vulnerability response has just one full-time employee. Google paused its open-source bug bounty program in early October after a flood of invalid AI-generated reports, according to headlines. Anthropic launched a free AI vulnerability scanner for open-source projects on 9 October. The bottleneck moved from finding bugs to fixing them.

Tools are not the same as maintenance

That distinction matters for how the OpenAI hire should be read. A national security counselor can help OpenAI sell AI to governments and allies. Driscoll's brief includes helping internal teams understand the operational needs of national security institutions, building on OpenAI's Daybreak program for cyber resilience, CNBC reported. But the vulnerabilities that AI is best at finding sit in code maintained by volunteers and small teams. They do not sit in the systems OpenAI sells.

Open source releases show the same tension from the other direction.

HeavyAI, formerly MapD, released its entire platform as open source in October 2026 under NVIDIA, according to its GitHub repository. The release included enterprise features that were previously closed. The repository describes HeavyDB as an in-memory, column store, SQL relational database designed to run on GPUs. That is a large codebase moving into public view. Every such move adds surface area for attackers and for defenders.

"A clean result is not a clean bill of health," the Zero Breach README states, adding that spyware of this grade is built to defeat exactly this kind of check.

Other releases point the same way. An open-source USB tool removes Nvidia's half-speed GPU AI limiter on Windows, covered by Tom's Hardware on 1 November. It lifts FP16 math performance up to 65 percent on RTX 20, 30 and 40 series desktops and laptops. The tool is a legitimate performance fix, but it also shows how quickly hardware-level restrictions become community projects. OpenBSD 8.0 arrived on 31 October with expanded hardware support and security enhancements, according to InfoQ. Google and Meta open-sourced TorchTPU to bring native PyTorch support to Google TPUs, InfoQ reported on 2 November. Each is a small addition to the commons, and each needs someone to watch it.

What the record actually supports

The record does not support a claim that OpenAI's hire will fix open source security. It supports something narrower. A large AI lab is staffing up on national security advice at the moment when governments are being told that AI-driven attacks are coming. It is also a moment when the maintainers of the internet's plumbing are short of people. The UK's National Cyber Security Centre warning, dated 3 November, and the Palo Alto Networks CEO's comment to CNBC TV18 on 2 November both point at the same gap. That comment said cyberattacks will accelerate as AI makes hacking easier.

There is also a funding angle.

OpenAI is seeking to raise up to $20 billion in a new funding round co-led by UAE investors, CNBC reported on 2 November. Altman signed agreements with Abu Dhabi entities spanning energy, government and investment. These include a five-year agreement between Inception42 and OpenAI to enable adoption of frontier AI across government, enterprise and education. National security work and sovereign money are moving through the same doors.

For readers trying to follow the open source vulnerability story, the practical signals are less dramatic than a hire. Watch whether AI-generated bug reports help or clog maintainers, as the Google bounty pause suggests they can. Watch whether free scanners from Anthropic and others reach projects that have no security staff. And watch whether the people now advising OpenAI on national security say anything about the volunteer code their tools depend on. On the record so far, they have not.