# OpenAI Joins 117-Company Pact to Speed AI Cyber Defense Rollout > Source: > Published: 2026-08-28 04:07:07+00:00 OpenAI and Anthropic were among the companies that published an open letter on August 27, 2026, calling for a coordinated, worldwide push to strengthen AI-enabled cyber defenses. By an August 28 check of the official signatory page, 117 organizations had added their names, spanning cloud providers, chipmakers, banks, and security vendors. The letter lands a day after [OpenAI](https://www.kobaran.com/tag/OpenAI) released its final report on the Hugging Face breach, and it frames its urgency around a prediction that AI-assisted attacks will keep spreading and growing more sophisticated in the months ahead. The document does something most industry statements skip: it assigns different, specific jobs to four categories of actors, from ordinary organizations patching known flaws to frontier AI companies handing out vetted model access. It also proposes a cost-control idea worth noting, using cheaper models for broad scanning and saving frontier-level systems for the hardest problems, so defensive coverage can scale without runaway compute spending. What the letter does not do is just as telling. It sets no legal obligations, no funding figures, no audit mechanism, and no timeline. It also stays silent on halting frontier model development or containing a model that misbehaves, treating that as a separate problem from defending everyday infrastructure. Whether 117 signatures becomes an operating defense network, rather than a symbolic show of alignment, will depend on what gets measured next. ## How 117 organizations divided the work among four groups The signatory list mixes sectors that rarely appear together in the same document. Cloud companies like AWS and Oracle sit alongside semiconductor firms such as AMD and Arm. Internet infrastructure players including Akamai, Cloudflare, and Equinix joined too, as did defense product vendors like CrowdStrike, Fortinet, and Palo Alto Networks. Financial institutions rounded out the list, with Capital One, Mastercard, and Visa all signing on. As of the August 28 check, the total stood at 117. Rather than asking everyone to do the same thing, the letter splits responsibilities by actor type, along with how each group’s progress should be judged. | Actor | Requested Actions | How Success Is Measured | |---|---|---| | All organizations | Fix critical weaknesses and adopt least-privilege access and strong access controls. Include AI-generated code in procurement and development standards | Whether fixes can be made without halting essential operations | | Security firms and technology partners | Continuously test defenses against frontier-level attack capabilities and integrate AI into existing products. Support deployment in the field through fix verification | Number of organizations protected, containment time, whether fixes actually worked | | Governments | Coordinate threat intelligence and incident response at regional, national, and international levels, and direct funding to underfunded critical services | Whether hospitals, water utilities, and local governments can use defensive AI and authorized testing | | Frontier AI companies | Provide vetted model access, funding, training, and on-the-ground support. Build out observability tools and traceable agent IDs | Whether non-public reports lead to verified fixes | ### Trusted access instead of open release The organizing idea behind this division of labor is what the letter calls trusted access: giving highly capable offensive AI tools to authorized defenders rather than releasing them broadly. Paired with the plan to reserve frontier models for the toughest cases, the approach tries to widen defensive reach without assuming every task needs the most powerful, most expensive model available. ## A delivery mechanism for fixes, not a new standard Much of what the letter asks organizations to do is not new. Patching known vulnerabilities, enforcing least-privilege access, requiring strong authentication, and layering defenses already appear in the U.S. Cybersecurity and Infrastructure Security Agency’s voluntary Cross-Sector Cybersecurity Performance Goals 2.0, which CISA uses as a benchmark to help resource-constrained organizations prioritize high-impact security investments. ### What’s actually new here The novel piece is using AI to compress the time between finding a vulnerability and fixing it, then distributing that capability to organizations that could never build it in-house. The letter calls out hospitals, water utilities, and local governments by name, asking for support that goes beyond simply granting model access to include hands-on deployment help and verification that fixes work. For aging systems that cannot be taken offline for patching, it calls for compensating controls, paired with confirmation that those controls actually hold up. #### Discovery is not the same as safety There is a distinction worth holding onto here. AI can surface a flood of candidate vulnerabilities, but that alone does not make a system safer than it was before. Risk only drops once someone reproduces the issue, builds a patch, and a maintainer verifies and merges it into production. That the letter names “whether fixes actually worked” as a success metric signals a shift away from a pure race to discover flaws and toward the harder work of getting fixes shipped. ## Can AI agents leave a record of who did what? One requirement aimed squarely at frontier AI companies is a call to make agent identities traceable and accountable. Logging just a human user’s name or a shared API key does not show which model, in which specific run, took an action, or what it handed off to another agent. Without identity and action histories tracked down to the level of individual executions, revoking privileges after an intrusion or a malfunction becomes guesswork. ### NIST is already working on this This isn’t happening in a vacuum. In February 2026, the National Institute of Standards and Technology released a concept paper on applying existing identity standards to software and AI agents, covering identification, authorization, auditing, non-repudiation, and countermeasures against prompt injection. In other words, the letter’s demand for traceable agents overlaps with active public standardization work already underway. ### The gaps that remain Even so, the letter does not specify which identifiers or signature schemes to adopt. It leaves open how delegation from a parent agent to a child agent should be logged, and how records should reconcile across different cloud providers. If each of the 117 signatories builds its own proprietary identifier scheme, tracing an incident will break down the moment it crosses a company boundary. Without a shared specification and interoperability testing, traceability stays a company-by-company feature rather than a tool for collective defense. ## Can individual company track records become a shared framework? OpenAI and Anthropic each had vetted cyber-defense programs running before this letter existed. OpenAI’s Daybreak program has committed $17 million in API credits and direct support toward efforts including open-source security hardening. By OpenAI’s own self-reported figures as of August 28, the program has identified 858 issues across 41 codebases and produced 263 patches, of which maintainers upstream adopted 143, roughly 54.4 percent of what was produced. ### Why the adoption number matters more than the discovery number Those 143 adopted patches are one useful model for what the joint letter means by verified fixes. Reporting adoption separately from raw issue counts helps avoid treating every AI-generated candidate as if it were already a fix. Still, these are OpenAI’s own numbers, and the company has not disclosed how the 41 codebases were selected or whether any independent party audited the results. ### Anthropic’s parallel expansion Anthropic, for its part, has made Claude Mythos 5 available to a small group of vetted partners and announced plans to expand Project Glasswing to roughly 150 new organizations across more than 15 countries. Among the approximately 50 partners already participating, the company reports more than 10,000 high- and critical-severity vulnerabilities found. Like OpenAI’s figures, this is Anthropic’s own tally, drawn from a different population using different methodology, which means the two companies’ numbers cannot be lined up on the same scoreboard. Model vetting and monitoring still differ from company to company, and data retention and vulnerability-sharing procedures have not been standardized between them. The letter points both companies in the same direction, but it has not merged their existing programs into a single point of entry or a common rulebook. If hospitals and water utilities have to go through separate vetting for each company’s program, the administrative burden lands hardest on the organizations with the fewest resources to spare. ## What should be measured before the signatory count The letter predicts that AI-powered cyberattacks will spread and grow more sophisticated in the coming months, but it gives no rate of increase, no baseline period, and no specific regions expected to be hit hardest. The 117 signatures reflect a shared sense of urgency among OpenAI, Anthropic, and their peers, not a measured forecast of when or how much attacks will actually escalate. ### The implementation gaps The practical gaps are just as real. The letter carries no legal force and creates no binding obligation for any individual signatory. Nobody has set the size of a joint funding pool, how contributions would be divided, or a start date. Who would audit progress, and what happens if targets are missed, remain open questions. A shared plan for pausing frontier model development, or containing a model that goes off the rails, sits outside the letter’s scope entirely. Strengthening defenders and controlling the models themselves are being treated as two separate tracks that need to move independently. ### The real test ahead The next meaningful checkpoint will be whether signatory organizations publish, under shared definitions, how many facilities they protected, how long fixes took to land, and how many patches actually made it upstream. If a joint funding pool gets established with real deadlines, if a common specification for agent identifiers gets chosen, and if outside parties can verify the reported results, then the number 117 turns from a headline into an operating defense network. Until then, it is a statement of intent from OpenAI, Anthropic, and 115 other organizations, with the harder work still ahead.