OpenAI on August 27 published an open letter titled "A call for collective action on cyber defense," with more than 100 organizations signed on, including fellow AI labs Anthropic and Google, cloud providers Microsoft, AWS, and Oracle, and cybersecurity firms such as CrowdStrike, Okta, Cloudflare, and Cisco. Financial and infrastructure companies, including Capital One, Mastercard, and Visa, also joined, according to reporting from CNBC, TechCrunch, and The Wrap.

What the letter says

The letter argues that a narrowing window remains to shore up critical infrastructure — hospitals, water systems, and internet backbone providers among them — before AI-enabled cyberattacks scale up in sophistication and frequency. "In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable," the letter states, per CNBC's reporting. Rather than proposing new regulation outright, the signatories call on governments at the local, national, and international level to coordinate more closely with industry on defense, and commit their own frontier AI capabilities to protective use.

Tied to OpenAI's own cyber-defense push

The letter follows OpenAI's August 10 expansion of Daybreak, its program giving vetted defenders access to cybersecurity-oriented models and tools, into two tiers: a broader "Blue" tier covering incident response, malware analysis, and patch validation, and a vetted "Red" tier carrying GPT-5.6-Cyber, a model purpose-trained for exploit validation and vulnerability research. Anthropic and Microsoft have similar defensive programs — Mythos and a new platform called Perception, respectively — that the letter references as examples of the kind of AI-for-defense work it wants to see scaled up industry-wide.

Why it matters

The letter is notable less for its specific asks than for its signatory list: it puts fierce AI-lab rivals OpenAI, Anthropic, and Google, along with major cloud and cybersecurity vendors, behind a single shared statement — a rarer show of coordination than the safety pledges and competing model releases that have otherwise defined the industry's public posture in 2026. It also reflects a shift in framing, from AI cyber risk as a hypothetical to something labs say is already materializing: OpenAI has separately disclosed that its own evaluation agents were involved in a breach of Hugging Face's infrastructure earlier this summer, an incident that has sharpened industry attention on both the offensive and defensive potential of increasingly autonomous AI systems.