Table of Contents
Why 100+ tech giants are warning about AI cyber threats—while refusing to fix the problem themselves
The Warning Nobody Wanted to Write
On Thursday, something unprecedented happened in Silicon Valley. OpenAI, Anthropic, Google, Microsoft, Amazon, and over 100 other companies signed a joint open letter warning that AI-enabled cyberattacks against critical infrastructure are imminent. The message was urgent: “We have a limited window to strengthen cyber defences.”
But here’s what nobody in the tech press is talking about: This letter is the most damning admission of corporate hypocrisy in AI history.
Think about it. The same companies racing to build the most powerful AI models—models that, by their own admission, will make sophisticated hacking “cheaper and more accessible”—are now asking the world to prepare for the consequences. It’s like a fireworks manufacturer warning cities to buy better fire extinguishers while continuing to sell bigger fireworks.
And the kicker? They refused to commit to anything specific. No deadlines. No funding pledges. No binding agreements. Just a strongly worded letter and a request that everyone else clean up the mess.
The Uncomfortable Math of AI Cyber Threats
Let’s break down what these companies are actually saying:
Table
| What They Warn About | What They Continue to Build |
|---|---|
| AI makes hacking “cheaper and more accessible” | Releasing more powerful, cheaper AI models monthly |
| Critical infrastructure is at risk | Selling AI services to anyone with a credit card |
| Defenders need “most capable models” during incidents | Keeping frontier models behind paywalls and API limits |
| “Immediate collective action” needed | No specific commitments, deadlines, or investments |
The contradiction is so glaring it would be funny if the stakes weren’t life-and-death. Hospitals, water treatment plants, and power grids are already under attack. One recent incident involved an AI-generated exploitation script targeting U.S. water systems
. And the response from the companies whose technology enabled it? A letter.
Why This Letter Is Actually a PR Masterstroke
Before we dismiss this as pure cynicism, let’s give credit where it’s due. The open letter is brilliant strategic communication—for the signatories.
Here’s what they accomplished in 500 words:
- Positioned themselves as responsible actors — “Look, we warned you!”
- Shifted blame to governments and buyers — “You didn’t raise your security bar.”
- Avoided any binding commitments — No regulatory risk, no financial cost
- Set the stage for future defense contracts — “We told you to buy better security”
It’s the corporate equivalent of a doctor prescribing cigarettes while warning about lung cancer, then offering to sell you the chemotherapy.
The Axios report nailed it: signatories “stopped short of making any specific commitments, deadlines, or financial investments”
. In other words, this is a call to action for everyone except the people signing it.
The Real Threat Nobody’s Naming
The letter asks frontier AI companies to give defenders access to their “most capable models during major cyber incidents, along with significant funding, training, and hands-on support.”
But here’s the question nobody’s asking: Why do defenders need access to frontier models during incidents in the first place?
Because the attackers already have them. Because the same companies selling AI to legitimate businesses are, intentionally or not, arming the other side. Because the “democratization of AI” is a euphemism for “we made powerful tools available to everyone, including criminals, and now we’re surprised they’re being misused.”
The letter acknowledges this implicitly. It admits that AI “drastically lowers the time and expertise hackers need to understand and exploit complex systems”
. What it doesn’t admit is that this is a feature of the business model, not a bug.
What Should Have Been in the Letter
If these companies were serious, the letter would have read differently. Here’s what accountability actually looks like:
Table
| What They Wrote | What They Should Have Written |
|---|---|
| “Raise the security bar for what you buy, build, and deploy” | “We will pause releases of frontier models until independent security audits are complete” |
| “Give defenders access to capable models during incidents” | “We will provide free, unrestricted access to our best models to verified critical infrastructure defenders—starting today” |
| “Significant funding, training, and hands-on support” | “We pledge $500 million collectively to critical infrastructure defense in 2026, with transparent reporting” |
| “Immediate collective action” | “We commit to binding, enforceable safety standards with third-party oversight” |
None of this happened. Because binding commitments cost money, slow innovation, and invite regulation. And in the current AI arms race, those are considered worse outcomes than a few hospital ransomware attacks.
The Bigger Picture: AI’s Asymmetry Problem
This letter reveals something deeper about the AI industry: offense is always easier than defense.
Attackers need to find one vulnerability. Defenders need to protect everything. Attackers can automate at scale. Defenders need human judgment and institutional knowledge. Attackers share tools freely on dark web forums. Defenders operate in silos with legal barriers to information sharing.
AI amplifies this asymmetry. A single competent hacker with access to frontier models can now do what previously required a nation-state team. Meanwhile, a water treatment plant in rural America still runs on Windows XP and has one IT person who also manages the phone system.
The letter asks governments to “coordinate defence at local, national, and international levels” and “fund cyber defence”
. But coordination takes years. Funding takes budgets. Meanwhile, the next model drop is next Tuesday.
The timeline mismatch is the real vulnerability. AI capabilities evolve in weeks. Institutional defense evolves in decades.
Three Questions Every Leader Should Ask
If you’re running an organization—whether a startup or a hospital—this letter should prompt hard questions, not reassurance:
1. Are we buying security theater or actual defense?
The letter urges organizations to “fix highest-risk weaknesses.” But in an AI-enabled threat landscape, your highest-risk weakness might be a third-party vendor using AI-generated code that nobody fully understands. Do you know what’s in your stack?
2. Who profits from our fear?
The same companies warning about AI cyber threats are the ones selling AI security tools, cloud infrastructure, and consulting services. This isn’t a conspiracy—it’s just capitalism. But it means their incentives are aligned with managing the problem, not solving it.
3. What happens when the letter is forgotten?
In six months, this will be old news. The companies will have released new models. The attacks will have evolved. And the “limited window to strengthen cyber defences” will be narrower than ever. What are you doing this week to prepare?
The Bottom Line
This open letter isn’t a turning point. It’s a milestone in a predictable pattern: build powerful technology, profit from its diffusion, warn about its risks, and deflect responsibility.
The 100+ signatories aren’t villains. Many genuinely care about safety. But they’re trapped in a system where pausing, committing, or regulating feels like unilateral disarmament. So they write letters instead.
The real question isn’t whether AI-enabled cyberattacks are coming. They are. The question is whether we’ll hold the companies building these tools accountable for the world they’re creating—or whether we’ll keep accepting warnings as substitutes for action.
A letter is not a plan. A warning is not a defense. And responsibility without commitment is just good PR.
What’s your take? Should AI companies be held liable for misuse of their models? Or is the open letter the best we can expect? Let me know in the comments.
Recommended for you: