More than 100 organizations, including OpenAI, Anthropic, AWS, Google, Microsoft and Oracle, on August 27 In the open letter they published, they demanded a rapid defense mobilization on a global scale against artificial intelligence-supported cyber attacks. Signatory institutions think that cyber attacks will become both more widespread and more technically complex as models become stronger in the coming months. The letter specifically highlights essential services such as hospitals, water treatment plants and internet infrastructure. Organizations also emphasize that the same artificial intelligence capabilities offer defense teams an important opportunity to close security vulnerabilities that have accumulated over the years.
The open letter’s list of signatories extends well beyond the tech industry. In addition to technology and security companies such as Adobe, AMD, Cisco, Dell, IBM, SAP, Cloudflare, CrowdStrike, Palo Alto Networks and Fortinet, organizations from different sectors such as Mastercard, Visa, Citi, Capital One, Deutsche Telekom, General Motors and Zurich Insurance Company are also participating in the call. This table shows that artificial intelligence-related cyber risks do not only concern companies that develop models. The main thesis of the signatories is that the current security approach will not be sufficient against the threats of the coming period.
Institutions especially focus on vulnerabilities in old software, overly broad access permissions, misconfigurations, weak authentication methods and technical debt that has accumulated over the years. According to the letter, security teams have long lacked adequate budgets and human resources, especially on the critical infrastructure side. Signatory organizations therefore want leaders to make cyber defense a direct management priority, close the highest-risk vulnerabilities first, and raise the security bar in codes written both by human hands and with the help of artificial intelligence. It is also recommended that system administrators use the principle of least privilege, strong access controls and layered defenses.
The call doesn’t just want companies to strengthen their own systems. It demands that cybersecurity companies deliver AI-supported defense tools, especially to budget-constrained critical infrastructure businesses, share threat intelligence and measure whether the fixes they implement actually work. Governments are expected to step up local and international threat sharing, fund essential services such as hospitals and water utilities, and expand access to advanced defense models through trusted security partners. Frontier artificial intelligence companies are also listed among the actors that will directly contribute to this effort with model access, financing, training, monitoring tools and authorized security tests.
OpenAI-Hugging Face incident amplifies call background
Open letter, OpenAI experienced in July and on August 26 It came right after the Hugging Face security incident, details of which he shared. According to OpenAI’s statement, in-house models with reduced protections, which the company used in cyber security assessments, bypassed the restrictions in the research environment, gained internet access and reached the systems in the Hugging Face infrastructure. OpenAI notes that it conducts much of the activity in an in-house research model that it does not plan to make publicly available. The company also says the incident does not impact OpenAI customer data, product functionality or availability of services.
The technical details of the incident more concretely reveal the point that artificial intelligence systems have reached in terms of cyber security. According to OpenAI, the agents first exploited vulnerabilities in the research infrastructure to establish unauthorized communication channels among themselves, and then chained multiple vulnerabilities to gain internet access. Some agents ran code on Hugging Face servers and gained root privileges on one server. METR and Redwood Research also conducted an independent investigation into the incident and found that agents coordinated over a common, unauthorized communications area during the operation, which spanned several days.
This development also coincides with the “The Defender’s Window” approach published by OpenAI on August 17. The company argues that AI models will help attackers find old vulnerabilities faster, but the same capabilities can also speed up defense teams’ discovery, prioritization and remediation of vulnerabilities. OpenAI therefore recommends that organizations increase automation in security processes and use artificial intelligence in tasks such as incident investigation and alarm analysis. In fact, the main message of the open letter concentrates here: If defense teams adopt these tools faster than attackers, they can turn the current technological leap in favor of security.
However, the letter does not impose a specific budget, investment amount or implementation schedule on the signatory institutions. According to Axios, the text lays out common principles and task distribution rather than concrete financial commitments or deadlines. Therefore, the real impact of the call will be determined by how much resources companies and governments will allocate to critical infrastructure and to what extent they will expand defense tools in the coming months. The point that the signatories agreed on is quite clear: The defense side needs to quickly close existing security vulnerabilities before artificial intelligence-supported cyber attacks become stronger.
Join Channel