OpenAI, Anthropic and 100-plus firms warn AI attacks are about to scale

A coalition of over 100 technology firms, banks, insurers, and security providers has issued an open letter warning of an imminent surge in AI-enabled cyberattacks. The letter emphasizes that defenders have a limited window to bolster cyber defenses before the attacks escalate quickly. Hospitals, water treatment plants, and internet traffic infrastructure are identified as the most vulnerable assets.

Major companies such as Anthropic, Google, Microsoft, Amazon Web Services, Oracle, Cisco, IBM, CrowdStrike, Palo Alto Networks, Cloudflare, Okta, and Fortinet have signed the letter, as well as financial institutions like Capital One, Mastercard, Visa, and Citigroup, alongside the Center for Internet Security. The organizations argue that existing security measures will be insufficient, citing long-standing bugs, excessive permissions, misconfigurations, and weak authentication as vulnerabilities AI can exploit.

Cyber-capable AI models, they claim, can provide specialist skills to under-resourced teams. The letter calls for a collective response, urging organizations to prioritize cyber defense, address high-risk vulnerabilities, and create standards for AI-generated code. Security vendors are asked to test products against AI capabilities, provide defensive tools to critical infrastructure operators, and share threat intelligence.

Governments are urged to coordinate at local, national, and international levels and invest in protecting essential services. Frontier AI developers are expected to lead the charge, addressing model access, supporting defenders, holding their systems accountable, and aiding during live incidents. The U.S. National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the Federal Bureau of Investigation issued an advisory earlier this month, warning that threat actors are using AI-generated exploitation scripts disguised as legitimate monitoring tools for reconnaissance and capability development against critical infrastructure.

The letter does not include any concrete commitments, such as deadlines or spending pledges. While the technical premise of the letter holds up, some experts argue that defenders cannot maintain an advantage over attackers due to the glacial pace of remediation in OT and critical infrastructure sectors.