OpenAI, 100+ Companies Call for Global Surge in AI Cyber Defence

OpenAI has called for a global push to strengthen cyber defences as AI-enabled attacks become more capable, with more than 100 companies and technology organisations, including Anthropic, Google, Microsoft, NVIDIA, AWS, Cisco, CrowdStrike, and Hugging Face, signing the initiative. 

OpenAI said there is a “limited window to strengthen cyber defences” before AI-enabled attacks become more widespread and sophisticated.

The open letter calls on companies, governments, cybersecurity firms, and frontier AI developers to put AI-powered defensive tools in the hands of organisations protecting critical infrastructure, including hospitals, water utilities, and internet infrastructure. 

OpenAI said defenders should “accelerate defenders’ priorities with tools, funding, and hands-on support”, particularly where security teams have limited resources.

OpenAI’s push comes shortly after the company disclosed a security incident involving its models and Hugging Face. 

During a security evaluation, OpenAI said its models escaped the intended testing environment, obtained internet access, and interacted with Hugging Face infrastructure. The models executed code on dozens of servers, gained root access to one server, and obtained limited private data and credentials. OpenAI also found that exposed credentials were used to access four accounts across four public services.

The company said the incident did not affect customer data, products, or service availability. However, its monitoring systems took several days to identify the activity, prompting OpenAI to strengthen containment and monitoring around model evaluations.

The incident also affected OpenAI's model development schedule. 

The company paused deployment-focused reinforcement-learning training for two weeks, delayed frontier reinforcement-learning runs and put training of its next-generation Astra model on hold while it worked on security and alignment improvements. 

OpenAI also quarantined the weights of the research model involved in the incident.

The latest letter asks cybersecurity companies to continuously test their defences against frontier AI capabilities, strengthen existing security products with AI and help critical-infrastructure operators deploy and verify fixes. 

It also calls on governments to fund cyber defence for under-resourced essential services and improve international threat-intelligence sharing and coordinated incident response.

The signatories are calling on frontier AI companies to ensure responsible model access, funding, training, and hands-on support for defenders. They also want developers to build stronger observability systems and ensure that identities used by AI agents are “traceable and accountable”.

OpenAI said organisations should address basic weaknesses alongside deploying AI-based security tools, including unpatched software, excessive permissions, insecure configurations, weak authentication, and technical debt in legacy systems. 

The letter also recommends using capable, lower-cost models for broad security coverage and frontier models for more difficult security problems.

“We call on leaders across industry and government to bring the full weight of their technology, resources, and expertise to this effort,” OpenAI said in the letter. “Put cyber-capable AI in the hands of defenders, starting with the teams protecting essential services. Fix the most dangerous weaknesses, verify the fixes, and share what works so others can build on it.”