More than 100 artificial intelligence and cybersecurity companies have told the federal government that a major cyberattack escalation could arrive within months, driven by AI systems that can now do work once reserved for skilled human hackers. The signatories include OpenAI, Anthropic, Amazon Web Services and Microsoft, and their joint letter frames the risk as immediate rather than theoretical, with critical infrastructure, businesses and national security named as the most exposed targets.
The core concern is speed. AI models can scan vast volumes of computer code and surface exploitable weaknesses far faster than a person working alone, according to John Licato, an associate professor at the University of South Florida, who said these systems can find vulnerabilities in code at a scale no individual hacker could match. That capability shift is what separates this warning from earlier cybersecurity alerts: the bottleneck of human labor that once slowed large-scale attacks may be disappearing.
The letter also arrives at a moment of heightened public unease about AI’s reach into jobs, privacy and security, and it does not pretend the technology is only a threat. The same companies pitch AI as central to the defense, even as they stop short of committing to deadlines, funding or specific action items tied to the risks they describe.
What the Warning Says #
The letter’s central claim is that tasks which once required highly skilled hackers and considerable time could increasingly be automated or accelerated by AI. That includes code analysis, vulnerability discovery and, potentially, the execution of attacks themselves. The signatories are not describing a distant risk; the letter points to a window of months, not years.
Why Critical Infrastructure Is the Focus
V.S. Subrahmanian, a professor at Northwestern University, said an AI-accelerated cyberattack aimed at infrastructure could carry real-world physical consequences rather than just data loss. He pointed to hospitals, electrical systems and water treatment facilities as examples of what could be disrupted.
“This could be very serious. So think water treatment plants, far more chemicals could be released into water that we all drink than is the appropriate amount. Electricity could be turned off to critical facilities,” Subrahmanian said.
| Sector | Potential Consequence Cited |
|---|---|
| Water treatment | Chemical dosing errors affecting drinking water safety |
| Electrical grid | Power shutoffs to critical facilities |
| Hospitals | Disruption to essential health services |
Beyond Stolen Data
The letter’s framing marks a shift from the cyberattack conversation most people are used to, which typically centers on stolen passwords or exposed personal records. Subrahmanian’s comments suggest the AI-driven version of this threat is less about identity theft and more about physical-world disruption.
AI as Both Threat and Defense #
The same letter that raises the alarm also positions AI as the best available countermeasure. The signatories argue AI can extend specialized cybersecurity expertise to organizations that could not otherwise afford it, making defensive work faster, cheaper and more effective. They are pushing for expanded collaboration and information sharing, so that a vulnerability or fix discovered by one company can be applied industry-wide before it is exploited elsewhere.
A Familiar Pattern, at New Speed
Subrahmanian noted that every major technology developed has functioned as both a threat and a solution, and said the public has every right to be concerned about AI. That framing puts the current cyberattack warning in a longer historical pattern, even as the letter itself argues that AI compresses the timeline on which that pattern plays out.
No Commitments Attached #
Notably, the letter stops short of concrete action. None of the more than 100 signatories announced specific deadlines, new funding commitments or individual investments tied to addressing the risks they describe. The warning functions as a public statement of concern rather than a binding plan, leaving the question of what happens next largely with regulators and the companies themselves.