OpenAI, Google, Microsoft and over 100 other tech companies write letter to energy, healthcare and other industries: ‘Prepare for AI-enabled hacking’
A group of leading technology giants, including OpenAI, Microsoft, Amazon Web Services, Anthropic, Google and more than 100 other companies have issued a joint public appeal, warning that critical institutions like energy, healthcare, financial services and water systems, among others have only months left to strengthen their digital defenses against artificial intelligence (AI)-powered cyber intrusions. The open letter emphasises that the window to shore up network protections is rapidly narrowing as automated, intelligent hacking capabilities become far more affordable and widespread for malicious actors.The industry alliance highlighted that key public utilities and services are facing heightened exposure to aggressive cyberattacks. This is due to rapid advancements in machine learning making sophisticated penetration techniques accessible to a wider circle of bad actors at a fraction of past costs.
Read open letter that tech companies have signed
To counter these emerging risks, the signatories are urging a coordinated response across public and private sectors. The coalition stressed the necessity of immediate, collective measures to reinforce vulnerable networks, aiming to dramatically raise the cost, time, and technical difficulty required for AI-assisted hackers to breach security perimeters.A call for collective action on cyber defenseAn open letter for a global surge in cyber defense.We have a limited window to strengthen cyber defenses.In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. The companies and public services our communities depend on—from hospitals to water treatment plants to the infrastructure that powers the internet—are at risk.Today’s AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years. If we act decisively, we can use the defenders’ window to make our digital world much more secure.We propose the following principles for a collective response:Recognize that status quo security won’t be enough. Longstanding bugs, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication, and technical debt in legacy systems have left systems exposed. Security teams, particularly for critical infrastructure, have been historically under-resourced and need a surge in tools and resources.Empower more defenders with cyber-capable AI. AI brings specialist skills to more defenders and makes core security tasks faster, cheaper and better. Sharing tools, practical knowledge, and verified fixes lets one organization’s work help protect many others.Mobilize a collective response. Cyber capabilities are advancing worldwide, and that can be a net positive: no single company should control the future. It also means a global response is necessary, requiring new partnerships to raise security standards and find new solutions to emerging cyber threats.Each of us can reduce risk now. All organizations, cybersecurity companies, technology partners, governments, and AI frontier companies have an important role: accelerate defenders’ priorities with tools, funding, and hands-on support, especially for critical infrastructure organizations with limited budgets.Here’s what we think needs to happen next:01Every organizationMake cyber defense an immediate leadership priority. Raise your security standards and meet them with the urgency and coordination of an incident that takes precedence over everything except critical business operations. Fix the highest-risk weaknesses, verify results without disrupting essential services, and raise the security bar for what you buy, build, and deploy, including AI-generated code. Upgrade or replace systems to build in least privilege, strong access controls, and defense in depth. Use capable, lower-cost models for broad coverage, and apply frontier capabilities to the hardest problems. Where a system cannot be patched without disrupting essential services, apply and verify compensating controls.02Cybersecurity companies and technology partnersHelp lead the response to defend against sustained AI-enabled attacks, including testing defenses continuously against frontier cyber capabilities, strengthening existing tools with AI, and working with technology partners to close gaps now. Make AI-powered defense accessible and deployable for critical-infrastructure operators, with hands-on help to deploy tools and verify fixes, and collaborate with critical infrastructure supply chain manufacturers and system integrators to patch and issue interim guidance. Share threat intelligence and tested playbooks, and measure progress by how many organizations are protected, how quickly attacks are contained, and whether fixes work.03GovernmentsCoordinate cyber defense at local, national, and international levels. Strengthen existing government and industry channels to share actionable threat intelligence, prioritize the most serious risks, and coordinate incident response and recovery around the world. Fund cyber defense, starting with essential services that lack the staff or budget to act. Expedite the expansion of trusted access programs, especially for critical infrastructure supply chains, and broaden access to defensive capabilities for other defenders. Give hospitals, water utilities, and local governments access to capable defensive AI, authorized testing, and hands-on support through trusted security providers and partners. Impose costs on attackers.04Frontier AI companiesProvide responsible model access, significant funding, training, and hands-on support, especially for under-resourced critical-infrastructure defenders. Build observability and security tools, ensure agentic identities are traceable and accountable, and share best practices in continuous monitoring. Invest in authorized testing, private disclosure, and verified fixes, and share tools, playbooks, and credible threat assessments with governments, security partners, and open-source maintainers to strengthen preparedness, response, and recovery.We can make the digital infrastructure we all depend on more secure.We call on leaders across industry and government to bring the full weight of their technology, resources, and expertise to this effort. Put cyber-capable AI in the hands of defenders, starting with the teams protecting essential services. Fix the most dangerous weaknesses, verify the fixes, and share what works so others can build on it. Together, we can turn today’s AI advances into lasting improvements in security that benefit everyone. Let’s put them to work.
