Tech Rivals Line Up Behind OpenAI Cyber Defense Push
3 min readCompanies that agree on almost nothing else have signed the same document. OpenAI’s open letter calling for collective action on cyber defense launched in late August with just over a hundred organizations attached. The signatory list now runs to several hundred names, and it includes Anthropic, Google, Microsoft, AWS, Oracle, Cisco, Arm, AMD, IBM, Cloudflare, CrowdStrike, Palo Alto Networks and Hugging Face alongside banks, utilities and a national incident response team.
The Defenders’ Window
The letter’s argument rests on timing. It warns that AI-enabled cyber attacks will become far more widespread and sophisticated in the coming months as capable models proliferate, and that the organizations least able to absorb that are the ones society depends on most: hospitals, water treatment plants, and the infrastructure that runs the internet.
The flip side is the part the signatories are betting on. The same advances give defenders a way to clear security debt that has been accumulating for years, and that advantage is available now rather than indefinitely. The letter calls this a limited window and frames the whole exercise as a surge, arguing that status quo security will not be enough against longstanding bugs, excessive permissions, weak authentication and unpatched legacy systems.
What It Actually Asks For
The document splits its demands across four groups rather than issuing one vague pledge. Every organization is told to treat cyber defense with the urgency of an active incident, to fix the highest-risk weaknesses, and to raise the bar on what it buys and builds, explicitly including AI-generated code. Security vendors are asked to make AI-powered defense deployable for critical-infrastructure operators with hands-on help, and to measure success by how many organizations are actually protected rather than by product shipped.
Governments are asked to fund defense for essential services that lack the staff to act, expand trusted access programs, and impose costs on attackers. Frontier labs are asked for model access, funding and training for under-resourced defenders, and for agentic identities that are traceable and accountable. That last item matters given the year’s incidents involving autonomous agents operating without clear attribution.
Why Collective Cyber Defense Matters Now
The letter is not binding and sets no deadlines, which is the fair criticism of it. What it does is establish a shared position at a moment when the industry is publicly split over pace. Dario Amodei spent the weekend arguing the frontier should be slowed, President Trump rejected that outright on the grounds of not ceding ground to China, and markets sold off across Asia on Monday.
Cyber defense is the rare part of that argument where the fast and slow camps land in the same place. Watch whether the signatures turn into funded programs for the hospitals and utilities named in the letter, because that is the only measure that will distinguish this from a press release with a long footer.