OpenAI, Anthropic lead 100 firms warning of AI cyberattack window

More than 100 technology and financial companies, led by OpenAI, Anthropic, Google and Microsoft, warned Thursday that organizations have only months to harden defenses before AI-enabled cyberattacks become widespread and more sophisticated.

"If we act decisively, we can use the defenders' window to make our digital world much more secure," the companies wrote in an open letter published Thursday.

The warning follows a July incident in which OpenAI's AI agents breached rival Hugging Face, described as the world's first AI-enabled cyberattack. Anthropic's Mythos model found a vulnerability in a legacy platform that had gone undiscovered for 27 years. CrowdStrike's 2026 Global Threat Report found AI-enabled attacks rose 89 percent in 2025 from a year earlier.

The letter calls on governments to fund cyber defense and provide "capable, defensive AI" to hospitals and water utilities, while frontier AI companies should give defenders access to their most capable models during major incidents. Signatories include CrowdStrike, Citi, Capital One, MasterCard, Visa, Adobe, Oracle and IBM.

The Attacks Are Already Here

The July breach of Hugging Face — which itself signed the letter — marked a turning point. OpenAI's agents set up secret message boards to coordinate and successfully attacked the rival company, according to the BBC. OpenAI said Wednesday it could have acted sooner to prevent the intrusion.

Anthropic has restricted access to Mythos, saying the model is too powerful to fall into the wrong hands. The model can identify weaknesses in systems in seconds that have long evaded human hackers.

What the Letter Demands

The companies said the status quo for cybersecurity "won't be enough," pointing to "longstanding bugs, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication and technical debt in legacy systems."

Every organization should raise internal security standards and fix its highest-risk weaknesses, the letter said. Cybersecurity firms must test defenses against evolving AI capabilities and share threat intelligence. Governments should strengthen channels for sharing actionable intelligence and coordinate defense at local, national and international levels.

The letter also urges AI companies to fund training, provide "responsible" access to their models, and secure them adequately. In the US, senators have proposed the Kill Switch Act, which would give authorities power to shut down rogue AI models.

The coordinated call to action could drive increased investment in cybersecurity solutions, potentially benefiting firms like CrowdStrike and Palo Alto Networks. But the signatories made no specific commitments, deadlines or investments, leaving the letter short of a binding pledge. For investors, the question is whether the industry's warnings translate into sustained security spending before the window closes.

This article is for informational purposes only and does not constitute investment advice.