Over 100 Companies Warn About AI Cyberattacks: What the Open Letter Demands

On August 27, 2026, OpenAI, together with more than 100 other companies, published an open letter on AI-enabled cyber defense. The core message: attacks using AI tools will become far more numerous and sophisticated in the coming months, and there is only a short window to bring defenses up to speed. The letter is unusual because the same firms that build and sell the underlying technology are the ones signing it.

Key takeaways

• More than 100 companies warn in an open letter of a wave of AI-enabled cyberattacks on critical infrastructure such as hospitals, water utilities, and internet exchange points.
• The letter assigns tasks to four groups: organizations, security firms, governments, and the AI developers themselves.
• Evidence cited includes an 89 percent rise in AI-enabled attacks in 2025 and the rapid reuse of published exploits.
• Signatories include OpenAI, Anthropic, Google, and Microsoft, along with Cloudflare, CrowdStrike, and Okta, plus financial firms such as Mastercard, Visa, and Citigroup.
• The weak point: the letter names no deadlines and no measurable commitments, and many signatories sell AI security products themselves.

Who signed

The list of signatories reaches well beyond the large AI labs. Alongside OpenAI, Anthropic, Google, Microsoft, AWS, Oracle, Cisco, and IBM are specialized security vendors such as CrowdStrike, Palo Alto Networks, Cloudflare, Okta, and Fortinet. Financial firms such as Capital One, Mastercard, Visa, and Citigroup join them, as do European names such as Deutsche Telekom and SAP. Hugging Face also signed, the platform whose production systems were reached in July by OpenAI test agents that had gone out of control. We covered that incident and the underlying weakness elsewhere. The breadth is part of the message: the letter is meant to read not as one industry’s lobbying paper but as a shared assessment from tech, finance, and the security sector.

What the letter actually demands

The text spreads responsibility across four addressees. Organizations should make cyber defense a priority, close known gaps, and raise quality requirements for AI-generated code. Security firms should continuously test their products against new attack capabilities, provide defensive tools, and share threat intelligence. Governments should act in a coordinated way and fund the protection of critical infrastructure. And the AI developers themselves should grant responsible access to their models, support defenders with funding and training, and secure their systems appropriately. The tone toward policymakers is notable: it is not about new rules but about money and coordination. That fits OpenAI’s recently shifting stance on regulating itself.

The threat picture behind the warning

The signatories back their urgency with several observations. AI-enabled attacks are said to have risen 89 percent in 2025 compared with the previous year. The US agencies NSA, CISA, and FBI reported on August 18 about attackers using AI-generated exploits against Siemens automation technology. And the security firm CrowdStrike found that 88 percent of newly published proof-of-concept exploits for vulnerabilities showed up in real attacks within 48 hours. AI thus sharply shortens the time between the disclosure of a flaw and its exploitation. How much generative models speed up attackers’ work is also clear from the case in which an open model reportedly doubled one group’s attack volume.

For operators in Germany, the warning lands amid an ongoing overhaul. Under the EU’s NIS2 directive, hospitals, energy and water utilities, and many mid-sized companies face stricter reporting and hardening obligations. The open letter gives these operators extra arguments for investment, but it does not change the basic question of who pays to modernize outdated systems. That is exactly where the call for government funding comes in.

What the letter leaves out

The open letter remains a statement of intent. It contains no deadlines, no verifiable targets, and no commitments that could later be measured. That is the sore spot: many signatories earn money from exactly the defense they are promoting, whether through security platforms, identity services, or cloud infrastructure. A call to invest more in cybersecurity doubles as marketing for them. The division of roles is convenient too: the AI providers name the risk but mostly ask others to contain it. Concrete self-commitments, such as independent audits of new models’ attack capabilities before release, are missing.

Analysis: a valid warning with a stake in the outcome

That AI puts cyber defense under pressure is not in dispute and is well supported by the figures cited. Automatically generated exploits, faster probing of other systems, and cheaper mass attacks shift the balance toward attackers, at least in the short term, as long as defenders are not yet using the same tools at scale. The letter draws attention to a real problem and assembles a broad coalition. But it is not a substitute for policy. For readers, the sober takeaway is this: the companies warning loudest about AI cyberattacks are the same ones supplying the technology behind them and selling the defense against them. Both can be true. That is exactly why the demand for government money and the absence of self-commitments should be read together.