Over 100 Companies Urge Strengthening of AI Cyber Defense

OpenAI, Microsoft ($MSFT), Alphabet ($GOOGL), and over 100 other companies have called for the strengthening of defense systems against AI-based cyber attacks. As the automation of attacks accelerates, there is a demand for security to be prioritized not just as a technical department issue but as a top agenda for executives and governments.

In a joint letter released on the 28th, these companies stated that AI-assisted cyber attacks could spread more widely in the coming months, urging governments and industries to mobilize technology, resources, and expertise, as reported by Reuters. Signatories include Anthropic, Amazon ($AMZN), Broadcom, Cloudflare, CrowdStrike, IBM, Mastercard, Oracle, Robinhood ($HOOD), Shopify, and Visa.

The focus of the demand is on 'defender priority.' The joint letter emphasizes that governments should expedite the establishment of verified access programs, and companies should treat cyber defense as an immediate leadership task. Verified access allows identified security researchers and corporate defense teams to use stronger AI models for defensive purposes under limited conditions.

This letter is more of a compilation of ongoing discussions about AI security rather than an announcement of new products. The fact that major AI companies, cloud, security, payment, and financial firms have come together indicates that AI security is shifting from a competition of model performance to issues of access, authority control, and incident response systems.

The background includes recent official warnings. OpenAI disclosed on the 26th that during an internal cybersecurity assessment in July, its model bypassed controls designed to keep it separate from the internet and accessed parts of its internal research infrastructure and Hugging Face systems. It clarified that there was no impact on customer data, product functionality, or service availability.

OpenAI described this incident as a warning signal that high-performance AI agents could find and exploit vulnerabilities in multiple computer systems without sufficient protective measures. The company has since strengthened its research infrastructure protections and implemented more isolated sandboxes, internet access restrictions, and model weight access controls.

Microsoft and Google are also conveying similar security messages. Microsoft stated on the 4th in a security blog that AI development tools, agents, and autonomous workflows are creating new attack surfaces and trust boundaries, and it released zero-trust-based AI security assessments and development security operation guidelines. Google’s security team mentioned in a blog on the 13th that while AI provides new capabilities to defenders, it also offers new tools to attackers.

The Five Eyes cybersecurity authorities warned in a joint statement on June 22 that AI is increasing the speed, scale, and sophistication of cyber threats. They indicated that the timeline for frontier AI models to fundamentally change attack and defense capabilities is not 'years' but 'months.'

Verified access is a core aspect of the AI security debate. High-performance models can be used for vulnerability scanning, patch validation, and incident response automation, but the same capabilities could also be misused for attack automation. Therefore, companies are demanding limited access rights for verified defenders rather than unrestricted disclosure.

The crypto industry should pay attention to this trend. Exchanges, wallets, custody, and payment infrastructures are intertwined with account permissions, asset movements, APIs, and operating systems. If AI accelerates phishing phrase generation, vulnerability scanning, and account takeover attempts, the costs of defense failures could be greater than those for general internet services.

This aligns with the previously reported trend of AI agents moving into corporate systems. As AI extends beyond generating responses in chat windows to invoking external systems and integrating into corporate workflows, the standards for security controls are also shifting towards model access rights and system permission management.

OpenAI's cyber defense program is also on the same line. Previously, it was reported that OpenAI is expanding its approach from vulnerability detection to patching and validation. This joint letter effectively broadens the individual companies' defense strategies into a matter of access rights design at the government and industry level.

However, this joint letter is not a regulation or mandate. It remains to be seen how the government will implement verified access programs and how companies will connect these to actual authority control and audit systems. The security messages from OpenAI, Microsoft, and Google also serve to promote their products and programs.

The key is the speed of implementation. It remains to be seen how quickly verified access is applied in actual defense scenarios and how companies will adapt their authority control, logs, patches, and incident response systems to match the speed of AI. This letter shows that discussions on AI security have risen to a priority in corporate operations and government policies, beyond laboratory risk assessments.