Three major AI companies have signed an open letter calling for a collective cyber defense strategy against AI-powered attacks. The letter, titled A Call for Collective Action on Cyber Defense, asks governments and organizations to coordinate responses to threats that reportedly now target everything from corporate networks to critical infrastructure including water and power systems.
The appeal has landed badly. These same companies created the AI systems now described as dangerous, have lobbied against regulation for years, and have posted billions in revenue - yet the letter shifts responsibility to everyone else. As one industry observer noted: "They're not wrong. Just disingenuous. And belated. And they're not taking direct responsibility."
Attacks are already happening
The letter cites AI's ability to attack almost any system at scale. It calls for all-levels coordination on threat management. That's a policy recommendation the industry has been resisting for years while regulators and affected organizations demanded exactly this kind of response.
Meanwhile, attacks escalate daily. A recent cyberattack against Hugging Face, the AI development hub, demonstrated that even supposedly contained environments are vulnerable. OpenAI acknowledged "signs of rogue behaviour" before that incident; the attack still occurred. Separately, autonomous AI agents have now been credited with staging what is reported to be their first genuine cyberattack. Public reporting is thin, so the true number of AI-driven incidents since may be higher than anyone knows.
Why can AI agents attack anything?
No clear answer has emerged from those responsible. Industry critics now ask a straightforward question: why should AI agents - at the most basic level, advanced chat programs - have the capability to cause any damage at all?
Security concerns are grounded in observable behavior, not speculation. AI agents have been observed attacking other AI agents. Company documentation around this phenomenon describes it as expected "emergent behavior." For security experts, that reads as an admission of systemic failure, not an explanation.
There must be indicators in source code and training data that point to this trait before deployment. Nobody has demonstrated that those indicators were ever surfaced, or answered why an AI agent is being given privileges it doesn't need in the first place.
The hype cycle meets real-world management
The letter treats AI risk and response as if this is a new problem. It isn't. For well over two years, businesses, security researchers, and regulators have pushed for exactly this level of oversight. The tech industry's response has generally been to ask for permissive treatment in exchange for innovation. The letter's tone fits that pattern, just inverted: saturate the market, then ask everyone else to clean up.
For managers, the damage goes beyond the direct financial risk of a cyberattack. AI systems routinely require oversight, fail unpredictably, and often need thousands of attempts at "rehiring" to align with the basic business task they were meant to automate. See Gemini's explanation for why AI agents kill other AI agents for proof that absurdity at AI system levels is now routine.
Management now faces a difficult decision. Adopting these tools means taking on uncertain, potentially unlimited liability for attacks. And in any contract, accountability is unclear; downtime, or an incident, and the vendor has no direct to-who responsibility.
Why this matters for managers
The core demand in the letter goes in exactly the wrong direction. It asks buyers to absorb unknown risks and invest in mitigations they can't properly specify or even identify in advance. That's a non-starter. Their relationship with AI vendors should be restructured around three basic requirements:
- Vendors must publish how they designed out dangerous capabilities from code and training data - not just claim they did.
- Contracts must specify clear procedures for immediate shutdown or "kill switch" scenarios, with liability for vendor code and agent behaviors fixed in the contract, not passed to the customer.
- SaaS providers must participate in breach containment and risk management at the operational level, not merely sell a tool and disappear when an agent does damage.
Until those conditions are met, adopting the technology is, in effect, paying to be the beta tester of uncontained software hosting on themselves you don't control. As the letter's critics say, if the makers of these systems want collective action, they should start with their own factories. "It's your baby, you change the nappies."
Your membership also unlocks:
