Prohibited Use: Cyberweapons and Critical Infrastructure Attacks

What it is

The policy prohibits using Cohere's AI to write malware, cyberweapons, or attack tools, and to plan or execute attacks against critical infrastructure such as power grids, water systems, or financial networks.

Why it matters (compliance & governance perspective)

This provision covers both the creation of offensive tools and their potential deployment against critical infrastructure, meaning operators in cybersecurity contexts must assess whether legitimate security research or penetration testing use cases could be construed as prohibited.

Consumer impact (what this means for users)

Operators and users cannot use Cohere's services to generate functional malicious code or to support cyberattacks, including against critical infrastructure, regardless of stated research or testing justifications unless those use cases are separately authorized.

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages the US Computer Fraud and Abuse Act (CFAA), the EU's Directive on Attacks Against Information Systems (2013/40/EU), the UK Computer Misuse Act, and critical infrastructure protection frameworks such as CISA regulations. The EU AI Act also addresses AI use in contexts that could affect critical infrastructure. GOVERNANCE EXPOSURE: High for cybersecurity firms, penetration testing providers, and security researchers who use AI to assist with offensive security work. The boundary between authorized penetration testing and prohibited cyberweapon creation requires careful operational definition. JURISDICTION FLAGS: The US, EU, and UK all impose criminal liability for unauthorized computer access and cyberweapon deployment. Organizations providing cybersecurity services internationally face multi-jurisdictional exposure. US government contractors may face additional obligations under FISMA and sector-specific cybersecurity frameworks. CONTRACT AND VENDOR IMPLICATIONS: Cybersecurity vendors and managed security service providers using the Cohere API should assess whether their authorized offensive security use cases require specific permissions or carve-outs from Cohere. B2B agreements should address the boundary between permitted security research and prohibited cyberweapon creation. COMPLIANCE CONSIDERATIONS: Operators in the cybersecurity sector should document the distinction between their authorized use cases and the prohibited categories in this provision, implement controls to prevent generation of deployable malicious code, and consider whether their terms of service adequately restrict downstream misuse by their own users.

Applicable agencies

Provision details

Other risks in this policy

• Prohibited Use: CSAM and Sexual Content Involving Minors high
• Prohibited Use: Weapons of Mass Destruction and CBRN Content high
• Prohibited Use: Non-Consensual Synthetic Media and Deepfakes high
• Prohibited Use: Election Interference and Political Disinformation medium
• Operator Responsibility for Downstream Use high
• Restriction on Autonomous High-Stakes Decision-Making Without Human Oversight high