Companies including OpenAI and Anthropic published an open letter on August 27, 2026, calling for a worldwide strengthening of AI-enabled cyber defenses. As of an August 28 check, 117 organizations had signed on via the official page. The signatories predict that AI-assisted attacks will spread and grow more sophisticated in the coming months. Google and Microsoft also signed, with participants spanning semiconductors, telecommunications, finance, and security. Coming a day after OpenAI released its final report on the Hugging Face breach, the letter proposes distributing models, funding, and on-the-ground support to defenders—it does not address halting model development or containment.
Still, it would be premature to read 117 signatures as the completion of a collective defense network. While the letter spells out detailed roles for each type of actor, it does not specify by when, who will contribute how much funding, or who will audit the shared mechanisms. The real test is whether AI's ability to find vulnerabilities can be converted into verified fixes and field-level operations.
How 117 organizations divided the work among four groups
The signatory list includes cloud companies such as AWS and Oracle, and semiconductor firms such as AMD and Arm. Internet infrastructure companies including Akamai, Cloudflare, and Equinix also joined. Defense product vendors like CrowdStrike, Fortinet, and Palo Alto Networks appear alongside financial firms such as Capital One, Mastercard, and Visa. As of the August 28 check, 117 organizations were listed on the official page.
Rather than treating all participants the same, the letter assigns distinct tasks to four types of actors.
| Actor | Requested Actions | How Success Is Measured |
|---|---|---|
| All organizations | Fix critical weaknesses and adopt least-privilege access and strong access controls. Include AI-generated code in procurement and development standards | Whether fixes can be made without halting essential operations |
| Security firms and technology partners | Continuously test defenses against frontier-level attack capabilities and integrate AI into existing products. Support deployment in the field through fix verification | Number of organizations protected, containment time, whether fixes actually worked |
| Governments | Coordinate threat intelligence and incident response at regional, national, and international levels, and direct funding to underfunded critical services | Whether hospitals, water utilities, and local governments can use defensive AI and authorized testing |
| Frontier AI companies | Provide vetted model access, funding, training, and on-the-ground support. Build out observability tools and traceable agent IDs | Whether non-public reports lead to verified fixes |
At the center of this division of labor is "trusted access"—giving highly capable offensive AI to authorized defenders rather than releasing it broadly. The letter also proposes using low-cost models to scan broadly and reserving frontier models for the hardest problems. Rather than assuming high-performance models should be used for everything, the idea is to expand defensive coverage while controlling costs.
A delivery mechanism for fixes, not a new standard
Many of the measures the letter asks companies to adopt are not new security principles. Patching and least-privilege access, along with strong authentication and layered defense, already appear in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) voluntary Cross-Sector Cybersecurity Performance Goals 2.0 for critical infrastructure. CISA uses these goals as a benchmark to help smaller organizations focus investment on high-impact measures and gauge their own maturity.
What is new here is the idea of using AI to speed up the process from detection to remediation, and distributing that capability to organizations that cannot build it themselves. The letter specifically names hospitals, water utilities, and local governments, calling for support that goes beyond model access to include deployment work and verification of fixes. Where aging equipment cannot be taken offline for patching, the letter calls for applying alternative compensating controls and confirming that they actually work.
There is a line that must be respected here. Even if AI surfaces a large number of candidate vulnerabilities, that does not mean systems are safer than before the fixes are applied. Risk is only reduced once reproduction testing is done, a patch is created, and a maintainer verifies it and merges it into production. The letter's inclusion of "whether fixes actually worked" as a success metric reflects a shift in focus from a race to find vulnerabilities toward actual implementation.
Can AI agents leave a record of who did what?
Among the requirements for frontier AI companies is a call to make agent identities "traceable and accountable." Logging only a human user's name or a shared API key does not reveal which model, in which execution, took an action, or what it delegated to another agent. To be able to revoke privileges after an intrusion or a malfunction, it is necessary to trace identities and action histories down to the level of individual executions.
In February 2026, the U.S. National Institute of Standards and Technology (NIST) also released a concept paper on applying existing identity standards to software and AI agents. Its scope covers identification and authorization as well as auditing and non-repudiation, and it also addresses countermeasures against prompt injection. In other words, the joint letter's demands already overlap with an active area of public standardization work.
Even so, the letter does not specify which identifiers or signature schemes should be adopted. It also leaves open how delegation from parent agents to child agents should be recorded, and how logs should be reconciled across different clouds. If each of the 117 organizations implements its own proprietary IDs, post-incident tracing will break down at company boundaries. Without a common specification and interoperability testing, the goal of "traceability" cannot be applied across organizations for collective defense.
Can individual company track records become a shared framework?
OpenAI and Anthropic were already running vetted cyber-defense programs before the joint letter. OpenAI's Daybreak program has pledged $17 million in API credits and direct support for efforts such as open-source security hardening. In OpenAI's own self-reported figures as of August 28, the program identified 858 issues across 41 codebases and produced 263 patches. Maintainers upstream adopted 143 of them—about 54.4% of the patches produced.
Those 143 adopted patches offer one model for measuring the "verified fixes" the joint letter calls for. Reporting the adoption count separately from the number of issues found helps avoid conflating AI-generated candidates with fixes that actually made it into software. That said, the figures are OpenAI's own self-reported numbers, and the company has not disclosed the criteria used to select the 41 codebases or a common third-party audit procedure.
Anthropic has made Claude Mythos 5 available to a small number of vetted partners and announced it will expand Project Glasswing to roughly 150 new organizations across more than 15 countries. Among the roughly 50 partners already in the program, the company says more than 10,000 high- and critical-severity vulnerabilities have been found. These figures, too, are Anthropic's own tally, and the underlying population differs from OpenAI's count of issues found and patches adopted. The two companies' numbers cannot be compared as if they were on the same scoreboard.
At present, model vetting and monitoring methods differ from company to company, and data retention and vulnerability-sharing procedures have not been standardized. The joint letter has aligned the companies in the same direction, but it has not consolidated their existing programs into a single point of entry or a common set of rules. If hospitals and water utilities must undergo separate vetting for each company's program, the burden of adoption will continue to fall on those with the fewest resources.
What should be measured before the signatory count
The joint letter predicts that AI-powered cyberattacks will spread and grow more sophisticated "in the coming months." However, it does not specify a rate of increase, a baseline period, or the regions expected to be affected. The 117 signatures reflect a shared sense of urgency, but they are not the result of having measured when or by how much attacks will actually increase.
The gaps in implementation are also significant. The letter carries no legal force, and it imposes no binding obligations on individual signatories. The total size of any joint funding pool and how contributions would be split have not been decided, nor has a start date been set. Who would audit progress, and what would happen if targets are not met, also remain unclear. A common plan for halting frontier model development, or for containing a model that has gone out of control, falls outside the letter's scope. Strengthening defenders and controlling the models themselves are separate efforts that need to proceed independently.
The next real test will be whether signatory organizations publish, under shared definitions, how many facilities they protected, how long fixes took, and how many patches were adopted upstream. If a joint funding pool and implementation deadlines are established, a common specification for agent IDs is chosen, and third parties are able to verify the results, then the number 117 will have turned into an operational defense network.