Leading labs, banks and insurers signed a letter saying today's security will not hold

An open letter published on August 27 asks industry and government for what it calls a surge in cyber defense. The claim underneath it is narrow and dated: in the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable. The signature list is the story, because of who is on it and how many.

Who signed

Counting the names printed on the letter gave 118 organizations on August 27. The list is open and it grows: on August 29 it stands at 155. Reports put the figure at a round hundred or at 116, which is why the list is worth counting with a date attached rather than quoting second hand.

The frontier labs are there, OpenAI, Anthropic and Google among them, alongside Microsoft, AWS, Oracle, IBM, SAP and Red Hat. So is most of the security industry: CrowdStrike, Palo Alto Networks, Fortinet, Zscaler, Okta, Sophos, SentinelOne, Trail of Bits, Snyk and Socket. The part that is easy to miss is everyone else, because it says who now considers this their problem: Visa, Mastercard, Citi, Capital One, US Bank, Robinhood, General Motors, Flexport, Shopify, Deutsche Telekom, Zurich Insurance and Nationwide Building Society.

Hugging Face signed as well, having spent July containing an intrusion that began inside an OpenAI evaluation.

What it actually asks for

The letter divides the work between four groups rather than issuing a single demand.

• Every organization: treat cyber defense with the urgency of an incident, fix the highest-risk weaknesses, and raise the bar for what is bought, built and deployed, explicitly including AI-generated code. Where a system cannot be patched without disrupting essential services, apply compensating controls and verify them.
• Cybersecurity companies and technology partners: test defenses continuously against frontier cyber capabilities, make AI-powered defense deployable for critical-infrastructure operators with hands-on help, and measure progress by how many organizations are protected and how quickly attacks are contained.
• Governments: strengthen the channels for sharing actionable threat intelligence, fund cyber defense starting with services that lack staff or budget, and give hospitals, water utilities and local governments access to defensive AI. The letter also says, in three words, impose costs on attackers.
• Frontier AI companies: provide responsible model access, funding and training to under-resourced defenders, and ensure agentic identities are traceable and accountable.

What a letter is and is not

Nothing here is binding, no signatory commits a sum, and no date is attached to any of it. Read as policy it is thin. Read as a signal it is not, because the same companies that sell frontier models are asking governments to fund the defensive side, and because insurers, card networks and a carmaker put their names to a technical claim about the next few months.

The letter's own framing is that capability currently favors whoever moves first, and that this window closes. That is an argument for spending now, made by parties who would also be selling the tools bought with that spending. Both things are true at once.