OpenAI letter rallies tech firms on cyber defense

OpenAI has published an open letter, "A call for collective action on cyber defense," urging a global surge in defensive work before AI-enabled attacks scale. More than 100 companies have co-signed. The text is an industry pledge and a posture statement, not a regulation or a standard, and it commits no one to anything enforceable. The public signatory list can still grow.

"We have a limited window to strengthen cyber defenses," the letter says, arguing AI-enabled attacks will grow more widespread and sophisticated as models improve, with hospitals, water treatment and the infrastructure behind the internet named as exposed. The same capability cuts both ways. The letter leans on a "defenders' window," the idea that AI can help find and fix longstanding weaknesses faster than attackers can exploit them. Its three principles are that status-quo security will not be enough, that more defenders should be equipped with cyber-capable AI, and that the response has to be collective across companies and governments.

The operator-level asks are more concrete than the summaries suggest, per CyberScoop. Every organization is told to make cyber defense an immediate leadership priority, fix its highest-risk weaknesses, apply least privilege, and, where a system cannot be patched, verify compensating controls instead of accepting the exposure. The letter names the usual debt plainly: excessive permissions, misconfigurations, unpatched software, weak authentication, and legacy technical debt.

Cybersecurity firms are asked to test their products against frontier AI capabilities and make AI-powered defense usable by critical-infrastructure operators. Governments are asked to coordinate across borders, fund protection for essential services, and impose costs on attackers. Frontier AI companies, the letter's own authors included, are asked to keep autonomous AI systems traceable and accountable.

CNBC counted 116 companies and entities on board, and the names run past the AI labs, OpenAI, Anthropic, Google and Microsoft, into the security bench of CrowdStrike, Palo Alto Networks, Cisco, IBM, Cloudflare and Zscaler, and on into the payments rails of Visa and Mastercard. That breadth is the point. A letter signed at once by the model builders, the defenders and the transaction networks is trying to frame AI cyber risk as shared-infrastructure exposure, not a vendor pitch. It also lands after a run of real agent-security incidents, including OpenAI's own agent breaching a Hugging Face sandbox.

Some offers on this page may be paid placements or contain affiliate links.