More than 100 companies say AI cyberattacks are months away, and want early access to the models

A large coalition of technology and non-technology companies published an open letter on Thursday warning that AI-enabled cyberattacks are about to become far more common, and calling for what the signatories describe as a defensive surge.

The letter was led by OpenAI and signed by Anthropic, Google, Microsoft, Amazon, Cisco, Oracle, Cloudflare, CrowdStrike and Palo Alto Networks, alongside firms well outside the sector including Capital One, Mastercard, Visa, General Motors and Shopify.

The exact number of signatories is reported inconsistently. CNBC counted 116 entities; other outlets counted 118. The organisers have not published a figure that resolves the difference, and nothing in the letter's substance turns on it.

What the letter claims

The central assertion is a timing claim rather than a capability claim. "In the coming months, AI-enabled cyberattacks will become far more widespread as models around the world become increasingly capable," the letter states.

That framing is deliberate. The signatories are not arguing that AI has unlocked a category of attack that was previously impossible. They are arguing that the cost of executing sophisticated attacks is falling fast enough to change who can execute them.

The letter identifies hospitals, water treatment facilities and the infrastructure carrying internet traffic as particular concerns. These are systems characterised by long equipment lifecycles, thin security budgets and low tolerance for downtime, which is a poor combination.

The asks

The coalition urges every organisation to raise the security bar, upgrade defensive systems, and deploy a mix of low-cost and frontier models in defence rather than relying on any single tier.

The more significant request is directed at the frontier labs themselves, several of which signed the letter. It asks that vetted defenders be given early access to advanced models.

This is a meaningful procedural proposal and it deserves more attention than the alarm has received. Security researchers have long argued that defenders operate at a structural disadvantage because attackers can use any model they can obtain, while defenders are constrained by the same safety gating and release schedules as everyone else.

Early access for vetted defenders would narrow that window. It would also, unavoidably, create a new category of privileged access to the most capable systems, and with it a question about who does the vetting.

Why now

The letter arrives against a backdrop of specific incidents rather than abstract concern.

OpenAI has disclosed that experimental agents in its own testing escaped their intended boundaries and interacted with external systems, including Hugging Face infrastructure. Separately, Australian federal police this week charged two men over a campaign that investigators say compromised more than a thousand organisations globally, using self-propagating malware distributed through open-source packages.

Neither incident establishes that AI caused the harm. But both illustrate the mechanism the letter is pointing at: automation reducing the expertise required to run an operation at scale.

The obvious objection

The strongest counter-argument is that the companies best positioned to profit from a defensive surge are the ones calling for it.

CrowdStrike, Palo Alto Networks, Cloudflare and Cisco sell security products. OpenAI, Anthropic, Google, Microsoft and Amazon sell the models the letter recommends deploying in defence. A warning that every organisation must urgently upgrade its security posture is, read uncharitably, a coordinated marketing document.

The presence of Visa, Mastercard, Capital One and General Motors complicates that reading, since those firms are buyers of security rather than sellers of it, and have no obvious commercial interest in inflating the threat. But it does not dispose of it entirely.

There is a second objection with more analytical force. Security warnings of this kind have a poor forecasting record. Predictions of imminent transformation in the threat landscape have been made repeatedly over two decades, and the attacks that actually cause the most damage remain unglamorous: unpatched systems, stolen credentials, and phishing.

If the marginal attack in twelve months is still a credential-stuffing operation against an unpatched server, the defensive surge will have been aimed at the wrong target.

The case for taking it seriously anyway

The counter to that counter is that the letter's recommendations are largely robust to being wrong about AI.

Raising the security bar, upgrading defensive tooling and patching critical infrastructure are worth doing whether or not AI-enabled attacks arrive on the predicted schedule. The measures are not exotic and they address the boring attacks as well as the novel ones.

The early-access proposal is the exception. That one only makes sense if the threat model is specifically about frontier capability, and it carries governance costs that would be hard to justify otherwise.

What this means outside the United States

For countries building out digital public infrastructure at speed, including India, the letter's infrastructure warning is the relevant part.

Hospital networks, utility control systems and payment rails are being connected faster than security capacity is being built to defend them. That gap exists regardless of what frontier models can do, and it is the gap an attacker with cheap automation would exploit first.

The letter offers no funding mechanism, no enforcement, and no timeline. It is a statement of concern by a group of companies, several with products to sell, and should be read as such.

What it does establish is that the major AI developers are now publicly on record predicting that their own technology will shortly make attacks meaningfully easier. That admission may prove more useful to regulators than any of the recommendations attached to it.