OpenAI, Anthropic, Amazon Web Services, Microsoft and more than 100 other companies issued an open letter on Thursday warning that organizations now have only months to prepare for AI-enabled cyberattacks.
Why this matters
The signatories say hospitals, water treatment plants and other elements of critical infrastructure will face a swarm of hacking threats as AI makes sophisticated cyber capabilities cheaper and more accessible to attackers.
Main message of the letter
"We have a limited window to strengthen cyber defenses," the open letter states. The group calls for collective action and urges organizations to use the shrinking window to secure critical infrastructure and to make it more expensive and difficult for hackers using AI tools to break in.
Signatories include a mix of cloud providers, cybersecurity firms, AI companies, telecommunications and financial services firms, and think tanks.
Specific recommendations
The letter lays out a plan describing how companies, governments, and cybersecurity and AI firms should adapt to the changing threat landscape:
- Every organization should raise internal security standards and remediate its highest-risk weaknesses.
- Organizations should raise the security bar for what they buy, build, and deploy, including AI-generated code.
- Cybersecurity and technology companies must rapidly test and build tools that make "AI-powered defense" accessible and deployable for critical infrastructure operators.
- Companies should share threat intelligence with one another.
- Governments need to strengthen channels for sharing actionable threat intelligence, coordinate defense locally, nationally and internationally, and fund cyber defense.
- Frontier AI companies should give defenders access to their most capable response models during major cyber incidents and provide "significant funding, training, and hands-on support," especially for critical infrastructure providers.
Why the call is urgent
The open letter comes amid a wave of cyberattacks against critical infrastructure, including an incident targeting U.S. water systems that reportedly used an AI-generated exploitation script.
Critical infrastructure such as water systems and power plants have long had vulnerabilities in the tools that operate machinery, but attackers previously needed substantial time and expertise to understand those systems. Experts have said AI now drastically reduces the time and energy attackers must invest in those preparations.
Missing commitments
The signatories did not include any binding commitments, deadlines, or specific investment pledges in the letter.
Conclusion
The joint warning from more than a hundred companies highlights a limited time window to bolster defenses for critical infrastructure against AI-assisted cyber threats. The letter proposes a range of measures for industry, governments and tech firms, but stops short of concrete, enforceable commitments.
