The AI industry is sounding the alarm on a problem that it helped create.
On Thursday, a coalition of more than 100 tech companies, including OpenAI, Anthropic, Google, Microsoft and more, published a letter calling for collective action to strengthen cyber defenses as AI-enabled cyberattacks pose a growing threat.
"Today’s AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years," said the letter, which was published on OpenAI's blog. "If we act decisively, we can use the defenders’ window to make our digital world much more secure."
The letter recommends three broad principles for immediate defense: recognizing that the status quo isn't good enough, empowering cyber defenders with AI, and mobilizing a global collective response.
It also includes a list of suggestions across enterprises, governments and cybersecurity firms to protect against risk:
- All organizations should make cyber defense an "immediate leadership priority" by fixing high-risk weaknesses and raising security standards and meeting them with "urgency and coordination of an incident that takes precedence over everything except critical business operations."
- Cybersecurity and tech companies should help lead the charge to defend against AI-enabled attacks and use AI to strengthen existing methods of defense.
- Governments should coordinate defense at the local, national, and international levels, strengthen existing government defenses, fund response programs, and expedite the expansion of trusted access programs.
- Meanwhile, frontier AI companies should provide responsible model access, as well as "significant funding, training, and hands-on support" for infrastructure defenders. Additionally, they should build more observability tools to keep their models and agents traceable and accountable.
The letter comes as frontier AI companies continue to grapple with the capabilities of their most powerful models, especially as these models prove their power through incidents such as OpenAI's breach of Hugging Face. These models have grown so powerful that OpenAI has even opted to slow down development of its next-gen model, Astra, announcing earlier this month that it put its largest planned frontier reinforcement learning run "on hold" as it conducts smaller evaluations to test model behavior.
OpenAI President Greg Brockman addressed the shrinking window for cyberdefense, calling the breach of Hugging Face a "watershed moment for cybersecurity" in a recent essay. "I’ve spoken with many organizations over the past few weeks, and one theme is clear: they know they need to fundamentally uplevel their cybersecurity practices with unprecedented speed," he wrote.
Our Deeper View #
This letter finally says the quiet part out loud: no enterprise, AI lab, tech giant or government is fundamentally ready for the cybersecurity shift that frontier AI capabilities are forcing upon us. However, as it stands, the solution may have to be more than playing catch-up in defense. While AI gives defenders more capabilities, threat actors tend to have a 12-foot ladder for every 10-foot wall. OpenAI did a commendable thing in tugging the reins on Astra, even if it's only temporary. It's still an open question whether other labs will follow its lead and slow the development of their next models to allow cyber defense solutions to catch up.