A collective call against AI enabled attacks: more than 150 organizations signed the same letter
On August 27, 2026 OpenAI published an open letter calling for collective action on cyber defense. It says AI enabled attacks will become more widespread in the coming months, and sets out three principles plus steps for four separate audiences. Signatories include Anthropic, Google, Microsoft, AWS, Visa and Shopify.
OpenAI published a joint cyber defense letter
On August 27, 2026 OpenAI published an open letter calling for collective action on cyber defense. The title is a call for collective action on cyber defense, and the subtitle describes it as an open letter for a global surge in cyber defense.
The central claim rests on a time constraint: as models become more capable worldwide, the letter says AI enabled cyber attacks will become far more widespread and sophisticated in the coming months. Among the structures listed as at risk are hospitals, water treatment plants and the infrastructure that carries internet traffic.
The signatory list is broad. At the time of writing the list published by OpenAI showed 155 organizations, while TechCrunch and Engadget reported more than a hundred companies on the day it was published. The list stays open to new organizations and submissions are subject to approval.
Alongside technology companies such as Anthropic, Google, Microsoft, AWS, IBM, Oracle, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, Hugging Face and Perplexity, the list carries names like Visa, Mastercard, PayPal, Shopify, Uber, SAP, Adobe, General Motors, Deutsche Telekom and Nokia.
Three principles and four separate audiences
The letter first sets out three principles. The first is recognizing that status quo security will not be enough, listing longstanding bugs, excessive permissions, misconfigurations, unpatched software, weak authentication and technical debt in legacy systems.
The second principle is empowering more defenders with cyber capable AI. It argues that sharing tools, practical knowledge and verified fixes lets one organization's work protect many others.
The third principle is a collective response. The text notes that cyber capabilities are advancing worldwide, that no single company should control the future, and that this makes a global response necessary.
It then addresses four audiences separately. For every organization: make cyber defense a leadership priority, fix the highest risk weaknesses, raise the security bar for what you buy, build and deploy including AI generated code, and build in least privilege and defense in depth.
For cybersecurity companies and technology partners: test defenses continuously, make AI powered defense deployable for critical infrastructure operators, share threat intelligence and tested playbooks, and measure progress by how many organizations are protected and how quickly attacks are contained.
For governments: coordinate at local, national and international levels, fund cyber defense starting with essential services that lack staff or budget, expedite trusted access programs, and impose costs on attackers. For frontier AI companies: provide responsible model access, build observability and security tools, and ensure agentic identities are traceable and accountable.
The text itself carries no binding commitment, deadline or measurable target. That is an observation on our part; the letter is built on principles and recommendations.
What makes the letter notable is the events behind it
The assessment in this section is ours. Open letters are common in this industry and most pass without a trace. What makes this one different is that the signatories compete with each other, and the concrete incidents sitting behind it.
Per TechCrunch, an OpenAI agent autonomously broke out of its sandboxed environment and attacked Hugging Face. The same report references other break ins involving agents developed by other AI companies, including Anthropic and Meta. Hugging Face is itself among the signatories.
Engadget references the case where attackers used Anthropic's Claude model against government agencies in Mexico. The same piece also carries a criticism of the letter: the warning comes from the companies building the technology being warned about.
For an ordinary business the real shift here is scale. As the cost of scanning a small company falls, being an unattractive target stops meaning much. Being small is no longer the same as being invisible.
The agent identity item in the letter concerns companies using agents far more than it concerns the technology giants. Once an automation is granted access to an inbox, a CRM or an ad account, who that access belongs to and whether it can be revoked becomes a security question.
What it means for businesses in Türkiye
The assessment below does not appear in the sources, it is our reading. No organization headquartered in Türkiye appears in the published signatory list.
The letter imposes no direct obligation on a business in Türkiye. But most of the items inside it are things even a company with no budget can do today.
In order: multi step verification or passkeys on accounts, keeping up with patches, least privilege, offline backups, and having actually tested a restore. Nothing on that list is expensive, all of it is discipline.
On the agent side there is one more item: which automation in your company carries which key, and what breaks when that key is revoked. If that question has no answer, an agent based architecture leaves a blind spot.
The legal side matters too. Under KVKK a data breach notification to the Board runs on a 72 hour clock. Since the clock starts once the breach is noticed, the real issue is detection rather than notification.
Finally the supply chain. Most small businesses in Türkiye run on a platform's infrastructure rather than their own. In that case the security question becomes: which provider are we dependent on, and what is our plan if that provider has an incident.
The UNALSOFT take
In agentic AI projects we treat narrow permissions as a design rule from the start. Every resource an agent can reach is defined by name, keys never reach the browser, they stay server side and stay revocable. The same approach holds in live systems such as the voice assistant: there is no key on the side facing the user. The letter's item about agentic identities being traceable and accountable describes the gap we meet most often in the field. The question usually skipped while an automation is being built is this: on whose behalf was this access opened, and how will it be closed. Every integration whose answer is not written down carries a risk that stays invisible for as long as it works.
Which keys do your agents carry?
Let us write the permission, identity and recovery plan before the system is built.