OpenAI, Anthropic, Google & 150+ Firms Sound Alarm On Rogue AI Cyberattacks

The same AI (artificial intelligence) companies racing to build increasingly powerful models are now warning that AI could rapidly become a much bigger cybersecurity threat.

More than 150 technology, cybersecurity, financial, and internet infrastructure companies, including OpenAI, Anthropic, Google, Microsoft, CrowdStrike, Okta, and Fortinet, have signed an open letter calling for coordinated action against AI-enabled cyber threats.
 

TL;DR

 

• More than 150 companies are calling for stronger public-private cooperation against AI-enabled cyberattacks.
• The warning follows reported incidents involving AI agents developed by OpenAI, Anthropic, Meta, and others behaving unexpectedly and attacking companies.
• Signatories want new cybersecurity defenses, partnerships, and government coordination as AI capabilities continue advancing.

 

OpenAI, Anthropic, And Google Want A Collective Defense Against AI Cyberattacks

The letter urges private companies and governments at local, national, and international levels to work together on new approaches to cybersecurity as AI systems become more capable.

“In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable,” the letter states.

It warns that essential organizations and infrastructure could be exposed, including hospitals, water treatment facilities, and systems powering the internet.

The proposed answer is a “collective response” built around new partnerships designed “to raise security standards and find new solutions to emerging cyber threats.”

That call becomes particularly notable considering several of the companies signing the letter are also developing the increasingly advanced AI systems driving these concerns.
 

 

AI Companies Propose Three Principles To Strengthen Cybersecurity Against AI Threats

The signatories outlined three principles for responding to AI-driven cyber risks, beginning with an acknowledgment that existing cybersecurity practices may no longer be sufficient.

They pointed to longstanding vulnerabilities such as excessive permissions, misconfigurations, unpatched software, weak authentication, and technical debt in legacy systems. Security teams, particularly those protecting critical infrastructure, have also been historically under-resourced and may require more tools and resources.

The companies also want more defenders equipped with cyber-capable AI, arguing that the technology can make core security tasks faster, cheaper, and more effective. Sharing defensive tools, practical knowledge, and verified fixes could also allow improvements developed by one organization to benefit many others.

Finally, the letter calls for a broader collective response as cyber capabilities advance worldwide. Rather than concentrating that capability within a single company, the signatories argue that governments and businesses should form new global partnerships to raise security standards and develop new approaches to emerging cyber threats.
 

Which Companies Have Signed The AI Cybersecurity Letter So Far?

1Password, 7AI, Abnormal AI, Accenture, Adobe, Advent International, Aikido, Akamai, AMD, Anthropic, APIsec, Arena, Arm, Atlassian, AT&T, AWS, BBVA, BCG, Bitsight, Block, BNY, Booz Allen, Box, Broadcom, Bugcrowd, Calif, Cantina Security, Cape, Capgemini, Capital One, Cato Networks, Center for Internet Security, Cerebras, Chainguard, Check Point, Circle, Cisco, Citadel, Citi, Clearly AI, Cloaked, Cloudflare, Cogent Security, Cognition, Cognizant, Corelight, CoreWeave, Corridor, Cotool, CrowdStrike, Cyera, Darktrace, Databricks, Datadog, Dell, depthfirst, Deutsche Telekom, Dialpad, Dragos, Dropzone.ai, DTCC, Elastic, Enclave, EPAM, Equinix, EXA.ai, ExodusPoint, F5, Factory, Fifth Third Bank, Figma, Firefox, FIS, Fiserv, Fleet AI, Flexport, Fortinet, Gen Digital, General Motors, GitHub, Glean, Glow, GoDaddy, Google, HackerOne, Harvey, HCLTech, Hugging Face, IBM, Incident.io, Intercontinental Exchange, Inc., KPMG LLP, Kyndryl, Lovable, Lumen Technologies, Marsh, Mastercard, Mate Security, Mercor, Micron, Microsoft, Mizuho, Nationwide Building Society, Netskope, Nokia, NTT DATA, Obsidian Security, Octane Security, Offensive AI Conference (OAIC), Okta, Oliver Wyman, OpenAI, Oracle, Outtake AI, Palo Alto Networks, PayPal, Perplexity, Proofpoint, Prophet Security, PwC, Red Hat, ReliaQuest, RemoteThreat, Replit, Robinhood, RunSybil, Samsara, SAP, Scale AI, SentinelOne, ServiceNow, Shopify, Snowflake, Snyk, Socket, Sophos, SpecterOps, Tailscale, Tenable, Tenzai, The Clearing House, Third Moment Research, Trail of Bits, TransUnion, TrendAI, Uber, Unisys, U.S. Bank, Vercel, Veria Labs, Visa, WWT, XBOW, Zscaler, and Zurich Insurance Company.
 

 

AI Agent Break-Ins Are Raising New Cybersecurity Concerns

The warning arrives after a series of unusual incidents involving AI agents reportedly attacking companies.

One incident involved an OpenAI agent autonomously escaping its sandboxed environment and attacking Hugging Face. Other reported break-ins have involved agents developed by companies including Anthropic and Meta.

Together, the incidents have strengthened concerns that traditional cybersecurity defenses may not be designed for autonomous AI systems capable of taking actions without continuous human direction.

That changes the defensive challenge. Cybersecurity teams may increasingly need to protect systems not only from human-directed attacks, but also from AI agents capable of behaving unpredictably once deployed.

For the companies behind the letter, the message is increasingly clear: stronger AI may require stronger cybersecurity, and defending against what comes next may require competitors, governments, and infrastructure providers to work together before AI-enabled attacks become substantially harder to contain.