OpenAI, Google and 100+ Companies Warn of a Coming Wave of AI Cyberattacks

More than 100 companies have joined forces to warn that the world may have only a limited window to strengthen cybersecurity before AI-powered cyberattacks become more common and sophisticated.

The group includes OpenAI, Google, Anthropic, Microsoft, AWS, Cloudflare, CrowdStrike, Cisco, Hugging Face, Oracle and other companies across technology, cybersecurity, finance and infrastructure. Together, they signed an open letter calling for coordinated action from businesses, governments and AI developers.

Their message is straightforward: AI is making attackers more capable, but it can also give defenders better tools to protect vulnerable systems.

Key Takeaways

• More than 100 organizations have signed a joint cybersecurity open letter.
• Signatories include OpenAI, Google, Anthropic, Microsoft, AWS, Cisco, Cloudflare and CrowdStrike.
• They warn that AI-enabled cyberattacks could become significantly more capable in the coming months.
• Hospitals, water systems, internet infrastructure and other essential services are among the areas of concern.
• The group says traditional cybersecurity practices alone will not be enough.
• Companies want cyber-capable AI tools placed in the hands of more defenders.
• Governments are being urged to improve funding, threat intelligence sharing and international coordination.
• Frontier AI companies are being asked to improve monitoring and make AI agents more traceable and accountable. 

Why Are Tech Companies Warning About AI Cyberattacks Now?

AI models are becoming better at tasks that are useful in cybersecurity, such as finding vulnerabilities, analyzing software and automating technical work.

Those abilities can help security professionals—but attackers can potentially use similar capabilities.

The open letter warns that AI-assisted attacks could become more widespread as increasingly capable models become available around the world. 

The concern isn’t limited to technology companies. Critical services such as hospitals, water treatment facilities and internet infrastructure could also become targets.

Recent incidents involving autonomous AI agents have added urgency to the discussion, including cases where agents behaved unexpectedly during security testing. 

What Are the Companies Asking Organizations to Do?

The letter says cybersecurity needs to become an immediate leadership priority.

Organizations are encouraged to identify their most dangerous vulnerabilities, strengthen authentication and access controls, update outdated systems and verify that security fixes actually work.

The letter also specifically warns organizations to maintain strong security standards for AI-generated code. 

This matters because AI coding tools can speed up software development, but automatically generated code can still contain vulnerabilities.

How Can AI Help Cybersecurity Defenders?

The companies don’t see AI only as a threat.

They argue that the same technology could give defenders an advantage by making security work faster and more accessible.

AI systems could help teams analyze vulnerabilities, investigate suspicious activity, identify weaknesses and respond to incidents.

The letter calls for capable AI security tools to become more accessible, particularly for organizations protecting essential infrastructure that may not have large cybersecurity budgets. 

What Should Cybersecurity Companies Do?

Cybersecurity companies and technology providers are being encouraged to continuously test their defenses against increasingly capable AI systems.

They are also being asked to share threat intelligence and proven security practices rather than keeping useful information isolated within individual companies. 

If one organization discovers a new AI-enabled attack technique or an effective defense, sharing that knowledge could help other organizations respond faster.

What Does the Letter Ask Governments to Do?

Governments have a major role in the proposed strategy.

The signatories want governments to improve coordination between public agencies and private companies, strengthen international cooperation and provide additional funding for cyber defense.

Special attention is given to essential services that may lack the money or technical staff required to deploy advanced security systems.

The letter also encourages governments to improve access to defensive AI capabilities for hospitals, water utilities, local governments and other critical organizations. 

What Are AI Companies Expected to Do?

Frontier AI developers are being asked to take additional responsibility because they are building some of the world’s most capable models.

The letter calls on them to provide responsible access to advanced AI for cybersecurity defenders while investing in monitoring and security systems.

It also specifically recommends making AI agent identities traceable and accountable. 

That could become increasingly important as AI agents gain the ability to independently browse networks, execute code and perform longer sequences of actions.

AI companies are also encouraged to share credible threat assessments, security tools and defensive techniques with governments, security companies and open-source developers.

Why Is Collective Action Important?

Cybersecurity has traditionally involved individual organizations protecting their own networks.

AI could make that approach less effective.

An AI-powered attack technique discovered in one part of the world could potentially spread quickly. At the same time, a successful defensive technique could help thousands of organizations.

That’s why the letter emphasizes cooperation between AI companies, cybersecurity firms, governments and organizations rather than relying on one company to solve the problem. 

Interestingly, the signatories include direct AI competitors such as OpenAI, Anthropic and Google, showing that cybersecurity is one area where rival companies see value in working together. 

Does the Open Letter Make Any Binding Commitments?

No.

The letter lays out principles and recommended actions, but it does not establish mandatory deadlines, specific investments or legally binding commitments for the companies that signed it. 

That distinction matters.

The real impact of the initiative will depend on whether governments and companies actually turn the recommendations into stronger security practices, funding and defensive tools.

Why This Warning Matters

AI is changing both sides of cybersecurity.

Attackers may gain faster ways to discover weaknesses and automate parts of cyber operations. Defenders can use the same technology to detect vulnerabilities, investigate threats and respond more quickly.

That creates a race.

The companies behind the letter believe there is currently a “defenders’ window” where AI can be used to strengthen vulnerable systems before offensive AI capabilities become significantly more widespread.

The challenge is making sure defenders take advantage of that window.

Conclusion

The open letter from OpenAI, Google, Anthropic, Microsoft and more than 100 other organizations reflects growing concern about how AI could reshape cybersecurity.

Their warning isn’t that AI-powered cyberattacks are some distant possibility. They believe the threat could grow substantially within the coming months.

But AI could also become one of cybersecurity’s strongest defensive tools.

Whether that happens will depend on how quickly businesses, governments, security companies and AI developers can work together to strengthen the systems people rely on every day.

FAQs

1. What is the AI cyber defense open letter?

It is a joint initiative signed by more than 100 organizations calling for stronger global cybersecurity measures as AI-powered attacks become more capable. 

2. Which companies signed the cyber defense letter?

Signatories include OpenAI, Anthropic, Google, Microsoft, AWS, Cloudflare, CrowdStrike, Cisco, Hugging Face, Oracle, Perplexity and many others. 

3. Why are companies worried about AI cyberattacks?

More capable AI models can potentially help attackers automate technical tasks, discover vulnerabilities and increase the speed and scale of cyber operations.

4. Which systems could be most at risk?

The letter highlights critical services including hospitals, water treatment plants and infrastructure supporting the internet.

5. Can AI also improve cybersecurity?

Yes. AI can help defenders identify vulnerabilities, analyze threats and respond to incidents faster. The signatories want advanced defensive AI tools to become more widely available.

6. What are governments being asked to do?

Governments are encouraged to fund cyber defense, improve threat intelligence sharing, coordinate internationally and help critical infrastructure operators access advanced defensive tools.

7. Are the companies making legally binding commitments?

No. The letter proposes principles and actions, but does not impose specific deadlines, investments or legally binding requirements on its signatories.