AI cyberattacks are becoming a bigger concern for technology companies, governments and businesses as artificial intelligence systems become more capable. More than 100 major companies have now joined a call for stronger cyber defenses, warning that attackers could use increasingly advanced AI tools to make digital attacks more frequent and sophisticated.
The joint effort includes major technology and cybersecurity names such as OpenAI, Anthropic, Microsoft, Google, Amazon, IBM, Cloudflare, CrowdStrike, Oracle, Visa and Mastercard. The companies say there is a limited window to strengthen digital security before AI-enabled attacks become harder to contain.
The call comes as businesses are rapidly adopting AI for software development, automation, data analysis and security operations. While those tools can help defenders find vulnerabilities faster, the same technology can also give attackers new ways to identify weaknesses and scale malicious activity.
The message from the companies is therefore fairly simple: cybersecurity can no longer be treated as a secondary technology issue.
Why AI cyberattacks are becoming a bigger concern
Traditional cyberattacks can require significant time, technical knowledge and resources. AI can potentially reduce some of those barriers.
More capable models can assist with tasks such as analyzing information, identifying weaknesses, generating code and automating repetitive work. That does not mean every AI system can independently launch sophisticated attacks, but it does create concern that criminals could use increasingly capable tools to speed up parts of the attack process.
The companies behind the new initiative believe that this trend could accelerate as AI models improve.
In their joint letter, the organizations warned that AI-enabled attacks could become more widespread and sophisticated in the coming months. They also pointed to the exposure of essential services, including hospitals, water treatment facilities and infrastructure supporting internet services.
That makes the issue much broader than protecting individual websites or corporate networks.
A successful attack against critical infrastructure can affect large numbers of people and businesses at the same time.
More than 100 companies join the cyber defense effort
The initiative has attracted support from a wide range of industries.
The signatories listed by OpenAI include technology companies, cybersecurity providers, financial institutions, cloud businesses and other organizations. The list includes Microsoft, Google, Amazon Web Services, IBM, Cloudflare, CrowdStrike, Palo Alto Networks, Cisco, Dell, Mastercard, Visa, Shopify, ServiceNow and many others.
That variety is important.
Cybersecurity is not limited to technology companies anymore. Banks, payment networks, retailers, manufacturers, hospitals and public services all depend on connected systems.
An attack against one organization can also create problems for other businesses through suppliers, software providers or shared infrastructure.
The companies are therefore calling for a collective approach rather than expecting individual organizations to solve the problem alone.
What the companies are asking for
The joint letter sets out several areas where businesses, governments and AI companies should increase their efforts.
For ordinary organizations, the message is to make cyber defense an immediate leadership priority.
That includes fixing high-risk vulnerabilities, improving access controls, addressing outdated software and checking whether security measures actually work.
The group also recommends stronger protections around AI-generated code and encourages organizations to improve systems using principles such as least privilege and defense in depth.
For cybersecurity companies, the focus is on making defensive technology more accessible and continuously testing security systems against increasingly capable threats.
Governments are being asked to improve cooperation, share actionable threat intelligence and support organizations that protect essential services.
The companies also want frontier AI developers to provide responsible access to defensive capabilities and support organizations that may not have large cybersecurity budgets.
AI can also help the defenders
There is an important part of the story that goes beyond the threat itself.
AI is not only a potential tool for attackers.
Security teams can also use AI to identify suspicious activity, analyze large amounts of security information, investigate vulnerabilities and respond to incidents more quickly.
OpenAI and its supporting organizations specifically argue that cyber-capable AI can give defenders access to specialized capabilities and make some security tasks faster and less expensive.
That creates something of an arms race between attackers and defenders.
If criminals use automation to discover weaknesses faster, security teams need tools that can identify and close those weaknesses before they are exploited.
This is one reason the companies are calling for greater investment in defensive technology rather than simply warning about the risks of AI.
Critical infrastructure could face the biggest pressure
Some of the most serious concerns involve systems that society depends on every day.
Hospitals, water utilities, electricity networks, financial services and communications infrastructure all rely heavily on digital systems.
Many of these environments also contain older technology that cannot always be replaced quickly.
That creates a difficult security problem.
An organization may know that a particular system needs to be upgraded but cannot simply shut down an essential service to replace it.
The joint letter specifically calls for additional support for critical infrastructure organizations, particularly those with limited budgets and staffing. It also asks governments and technology companies to help these organizations deploy defensive tools and address security gaps.
The concern is not limited to the United States. Digital infrastructure is interconnected across borders, which means cyber threats can spread internationally.
Why outdated software remains a problem
AI may be the new element in the cybersecurity discussion, but many of the weaknesses being exploited are much older.
The companies behind the initiative point to problems including unpatched software, excessive permissions, weak authentication, misconfigured systems and accumulated technical debt.
That is an important distinction.
Organizations do not necessarily need to wait for a new AI security product to improve their defenses.
Basic security practices still matter.
Keeping software updated, removing unnecessary access, protecting administrator accounts, monitoring networks and maintaining tested backups can reduce exposure to many common threats.
AI can strengthen those defenses, but it does not replace them.
CISA has already been working on AI cybersecurity
The concerns raised by the technology companies are also consistent with work already being done by the US Cybersecurity and Infrastructure Security Agency.
CISA has previously identified AI as an important area for cybersecurity and infrastructure protection. Its work includes examining AI-related risks, secure AI adoption and the use of AI-powered cyber defense.
CISA also launched an AI Cybersecurity Collaboration Playbook designed to encourage cooperation and information sharing between government, industry and international partners. The agency said the initiative was intended to strengthen resilience against emerging AI-related cybersecurity risks.
That existing work shows that concerns about AI security are not limited to the latest industry letter.
Governments and security organizations have already been preparing for the intersection between artificial intelligence and cyber threats.
What AI-enabled attacks could mean for businesses
For businesses, the biggest change may be the speed at which threats develop.
A company that takes weeks to investigate a vulnerability may struggle if attackers can discover and exploit similar weaknesses much faster.
That puts pressure on security teams to automate routine monitoring and response.
It also means companies need better visibility into the systems they operate.
Businesses should know which software they use, which systems are exposed to the internet, who has access to sensitive information and where important data is stored.
This kind of visibility is also becoming important for businesses monitoring how their brands and digital assets appear across newer AI-powered platforms. Our guide on how to track brand mentions in Gemini explains one practical side of that changing search environment.
Without that visibility, even advanced security tools can have difficulty protecting an organization effectively.
Companies also need to consider their suppliers.
A business can have strong internal security and still be exposed through a third-party service provider, software package or connected partner.
Financial companies have another reason to pay attention
Banks, payment processors and financial technology companies are particularly attractive targets because they handle valuable financial information and transactions.
Several financial organizations are among the signatories of the new cyber defense initiative, including Capital One, Mastercard, Visa, U.S. Bank and other financial-sector companies.
This is also relevant to the broader development of financial technology.
As businesses build digital payment systems and online financial services, cybersecurity becomes part of the product itself.
For companies developing financial applications, security needs to be considered from the beginning rather than added after a system has already been deployed.
For more background on building financial technology products, see our guide to how to build a fintech app.
What companies should do about AI cyberattacks
The warning does not mean businesses should stop using artificial intelligence.
Instead, companies need to treat security as part of their AI strategy.
A sensible starting point is to review the most important systems and identify the vulnerabilities that could cause the greatest damage.
Organizations should then focus on practical improvements.
These can include:
- Updating vulnerable and unsupported software
- Using strong authentication for sensitive accounts
- Limiting administrative access
- Monitoring unusual network activity
- Maintaining reliable offline or protected backups
- Testing incident-response procedures
- Reviewing third-party suppliers
- Checking AI-generated code before deployment
- Training employees to recognize social engineering
- Sharing relevant threat information with trusted security partners
The goal is not to create a perfect security environment. That is unrealistic.
The goal is to make attacks harder to carry out and easier to detect and contain.
Why collective cyber defense matters
Cybersecurity information becomes more valuable when it can be shared quickly.
If one organization discovers a new vulnerability and keeps the information private, other companies using similar technology may remain exposed.
If the vulnerability and a tested fix can be shared responsibly, many organizations can improve their defenses at the same time.
That is one of the central ideas behind the new industry initiative.
OpenAI’s letter calls for stronger cooperation between companies and governments, along with greater sharing of threat intelligence, practical tools and tested security fixes.
CISA has similarly emphasized collaboration and information sharing through its Joint Cyber Defense Collaborative.
The reasoning is straightforward: cyber threats move quickly, so defensive information needs to move quickly too.
AI security is becoming a business issue
For years, cybersecurity was often treated as an IT department responsibility.
That approach is becoming harder to maintain.
A major security incident can interrupt operations, expose customer information, create legal problems and damage a company’s reputation.
When AI becomes more deeply integrated into software, customer service, finance, logistics and other business functions, the consequences of a security failure can become even broader.
This means executives and boards need to understand cybersecurity risks rather than leaving every decision to technical teams.
The companies behind the new letter are effectively making that argument by calling on organizations to make cyber defense a leadership priority.
The next phase of the AI security race
The cybersecurity industry is likely to see more investment in defensive AI as companies respond to these concerns.
Security providers are already working on systems that can identify suspicious behavior, prioritize vulnerabilities and help security teams investigate incidents.
The challenge will be making those tools reliable.
A security system that produces too many false alarms can overwhelm a small team. An automated system that makes the wrong decision can also create new problems.
For that reason, organizations will need a balance between automation and human oversight.
The most useful security systems may not be the ones that attempt to do everything automatically. Instead, they may be the systems that help security professionals understand threats faster and make better decisions.
What this means for consumers
Most consumers will not directly notice the technology behind the new cyber defense push.
However, they can still be affected by the outcome.
People depend on digital banking, online shopping, healthcare systems, telecommunications and other internet-based services every day.
If businesses and governments improve their defenses, consumers can benefit from stronger protection of personal information and more reliable digital services.
At the same time, consumers should continue following basic security practices.
Using unique passwords, enabling multi-factor authentication, keeping devices updated and being cautious with unexpected messages remain useful defenses.
AI may change the cybersecurity landscape, but many basic security habits still matter.
FAQs About AI Cyberattacks
What are AI cyberattacks?
AI cyberattacks are cyber threats in which artificial intelligence is used to assist, automate or improve parts of an attack. AI can potentially help with activities such as analyzing information, finding weaknesses or scaling certain malicious tasks.
Why are technology companies worried about AI cyberattacks?
Companies are concerned that increasingly capable AI systems could make some cyber threats more widespread and sophisticated. More than 100 organizations have joined a call for stronger collective cyber defenses.
Which companies signed the cyber defense letter?
The signatories include OpenAI, Anthropic, Microsoft, Google, Amazon Web Services, IBM, Cloudflare, CrowdStrike, Oracle, Visa, Mastercard and many other technology, financial and cybersecurity organizations.
Can AI help protect against cyberattacks?
Yes. AI can help defenders analyze security information, identify potential vulnerabilities, detect suspicious activity and speed up some security tasks. The companies behind the initiative are specifically calling for greater access to defensive AI capabilities.
What is CISA doing about AI cybersecurity?
CISA has been developing guidance and collaboration programs focused on AI cybersecurity. Its work includes AI risk assessment, secure AI adoption, cyber defense and information sharing between government and industry.
Are critical infrastructure companies at risk?
Yes. Critical infrastructure such as healthcare, water systems, energy and communications relies heavily on connected technology. The companies behind the new initiative specifically highlighted the need to provide additional cyber defense support to essential services.
What can businesses do to reduce AI cyberattack risks?
Businesses can start with basic security improvements such as patching vulnerabilities, strengthening authentication, limiting access, monitoring systems, testing backups and reviewing third-party risks. They can then add AI-based security tools where those tools provide a clear benefit.
Final Thought
The growing concern around AI cyberattacks is not simply about whether artificial intelligence will make hacking more powerful.
It is also about whether businesses, governments and security teams can improve their defenses quickly enough.
More than 100 companies have now backed a collective call for stronger cyber defense, with organizations from technology, finance, cybersecurity and other industries participating.
The timing is significant because AI adoption is moving quickly, while many organizations are still dealing with old software, weak configurations and limited security resources.
The good news is that the same technology creating new concerns can also help defenders.
The challenge is making sure those defensive capabilities reach the organizations that need them most, particularly critical infrastructure providers and smaller businesses.
For now, the message from the technology industry is clear: waiting for the next major cyber incident is not a good security strategy. Companies need to strengthen their defenses before AI-enabled threats become even harder to manage.