More than 100 tech and cybersecurity companies, including OpenAI, Anthropic, Google and Microsoft, have warned there is a “narrowing window” to act before AI-enabled attacks escalate to a level that puts critical public services at severe risk.
“In the coming months, AI-enabled cyber-attacks will become far more widespread and sophisticated as models around the world become increasingly capable. The companies and public services our communities depend on – from hospitals to water treatment plants to the infrastructure that powers the internet – are at risk,” the letter said.
The open letter, published on August 27, calls for collective action to ensure AI tools are available to defenders to enable them to discover new ways to secure systems.
The signatories said that current approaches to cybersecurity are not equipped to deal with the coming surge in AI-enabled attacks, with AI tools helping threat actors to rapidly target various vulnerabilities, such as excessive permissions, misconfigurations, insecure and unpatched software, weak authentication and technical debt in legacy systems.
Read now: ICS Operators Warned of AI-Driven Attacks on Siemens PLCs
AI also has the ability to make core security tasks cheaper and more efficient, the letter stated.
It urged a global response to unlock AI’s potential in cybersecurity, encompassing partnerships to raises security standards and sharing of knowledge and tools to tackle emerging threats.
The letter set out actions that should be taken by different stakeholders to make this vision a reality:
- Individual organizations need to make cyber defense an immediate leadership priority, focusing on addressing the highest-risk vulnerabilities and upgrading or replacing legacy systems
- Cybersecurity firms must work with technology partners to strengthen existing solutions with AI, and ensure AI-powered defense is accessible and deployable for critical infrastructure operators
- Governments should strengthen existing threat intelligence and incident response partnerships, and invest in stronger defenses for public services, including providing hospitals, water utilities, and local governments access to capable defensive AI
- Frontier AI companies, such as OpenAI and Anthropic, must provide responsible model access and offer support for its implementation, especially for critical infrastructure organizations
Commenting on the letter, Nick Benson, CEO at accreditations and training body CREST, welcomed the call for collective action amid evolving AI capabilities.
"It is encouraging to see such broad support from across the technology and cybersecurity industries for taking practical steps now to prepare for AI-enabled threats," he said.
“This is closely aligned with the work we are seeing across the CREST community. Our member companies are already exploring and deploying AI to strengthen cybersecurity capabilities, while recognising that its use needs to be responsible, transparent and properly governed. The opportunity is to strengthen our response to AI-enabled attacks while harnessing AI itself to enhance defensive capabilities," Benson added.
Tech Giants' Warning "Shouldn't be Taken Lightly"
The open letter was published amid recent reports of advanced AI models by companies such as Anthropic and OpenAI going "rogue" and escaped testing restrictions to attack third-party organizations.
As such, Keven Knight, CEO of Talion Cyber Security, said the stark warnings about threats from AI models shouldn't be taken lightly.
"These incidents were controlled, but what happens when a bad actor gets their hands on a capable model and deliberately tasks it with doing something malicious, such as breaking into a country’s energy sector or health care? It would be foolish to assume these incidents won’t happen soon. China is already working on models which are reported to have the same capabilities as Mythos and we would be naive to believe these models won’t be used to target the West," Knight said.
"Organizations and governments must take heed of this warning," he added.