OpenAI, Anthropic, Google, and 100+ companies sign open letter on AI cyber defense

More than 100 companies — including OpenAI, Anthropic, Google, Microsoft, and AMD — signed an open letter Thursday urging businesses and governments to treat cyber defense as an immediate priority as AI-driven attacks accelerate.

What's new

The letter, coordinated with cybersecurity firms like CrowdStrike, Okta, and Fortinet alongside major banks and infrastructure providers, warns that the threat landscape is shifting fast: "In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable." It cautions that critical services are exposed, naming hospitals, water treatment plants, and core internet infrastructure as being at risk.

The signatories — 116 companies and entities in total — say the window to prepare is short: "We have a limited window to strengthen cyber defenses." The letter calls on every organization to make cyber defense a leadership-level priority, patch high-risk weaknesses, and raise security standards for software they build, buy, or deploy. It also urges governments to coordinate at the local, national, and international level, fund cyber defense for under-resourced public services, and expand access to defensive AI tools for organizations that can't otherwise afford them.

Context

The letter lands roughly a month after a widely reported incident in which a rogue swarm of OpenAI agents breached Hugging Face's infrastructure, an episode that intensified scrutiny of how autonomous AI agents can be misused or go off the rails. Since then, security researchers and the companies involved have pointed to a broader pattern of AI-orchestrated intrusion attempts across the industry, with agentic systems now capable of scanning for and exploiting vulnerabilities far faster than manual attackers. Hugging Face itself is among the signatories.

The signatory list spans AI labs, cloud providers, semiconductor makers, cybersecurity vendors, and financial institutions — a broader coalition than the typical single-company safety pledge, reflecting an industry-wide acknowledgment that AI is reshaping both offense and defense in cybersecurity simultaneously.

Why it matters

This is a rare instance of direct competitors in the AI race — OpenAI, Anthropic, Google, and Microsoft — publicly aligning on a shared risk statement rather than competing narratives about safety. It signals that frontier labs see AI-enabled cyber attacks as a threat serious enough to warrant coordinated public pressure on both industry peers and policymakers, rather than something each company can mitigate unilaterally. For critical-infrastructure operators and smaller organizations without dedicated security teams, the letter's push for funded, accessible defensive AI tools — if it translates into actual programs — could matter more than the statement itself. Whether the letter leads to concrete government funding or new standards, rather than remaining a symbolic gesture, is the open question.