OpenAI just got more than 100 companies — Microsoft, Google, AWS, Anthropic, Cisco, CrowdStrike, Deutsche Telekom, SAP, Mastercard — to sign an open letter with a blunt warning: AI-enabled cyberattacks on critical infrastructure aren’t a hypothetical. They’re imminent.
The letter argues that hospitals, water utilities, and other essential services face the highest risk, and that “AI-enabled cyber attacks will become far more widespread and sophisticated.” But it’s not purely alarmist. The signatories make a case that defenders currently hold an edge, because “today’s AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years.” The window won’t stay open forever.
What’s notable here isn’t just the coalition size — it’s the specificity of the demands. Companies should elevate cybersecurity to the C-suite. Governments need to fund and coordinate defense efforts. AI companies should offer affordable security tools to underfunded organizations. And the letter doesn’t let anyone off the hook on basics: unpatched software and weak authentication remain gaping holes that no amount of AI can paper over.
The timing aligns with a joint NSA, CISA, and FBI advisory from mid-August revealing that attackers are already using AI to write exploit scripts against industrial control systems — specifically Siemens S7 systems across US energy, water, chemicals, and manufacturing. That’s not future-tense speculation. It’s happening now.
This letter reads less like a policy document and more like a coordinated signal to regulators that the industry wants guardrails before a catastrophic incident forces them. Whether the signatories actually follow through on making cheap security tools available to small utilities — the organizations least equipped to defend themselves — will determine if this is substance or just well-branded positioning.
