OpenAI Cyber Defense Letter: What It Says & Who Signed It

On 28 August 2026, OpenAI published an open letter, A Call for Collective Action on Cyber Defense, asking for what it calls "a global surge in cyber defense." What makes it news isn't the text alone; it's the signature block. More than 150 organizations have signed as of 3 September (the list is open and still growing), including companies that compete with each other daily: OpenAI alongside Anthropic and Google, Microsoft alongside AWS, plus names e-commerce stores already depend on, like Shopify, Visa, Mastercard, PayPal, and GoDaddy.

When that many rivals agree on something in public, the something is worth reading. Below: what the letter actually says, who signed, what it asks companies to do (translated for a store without a security department), and our take.

What "A Call for Collective Action on Cyber Defense" actually says

The letter is short, and its argument fits in a few of its own lines:

"We have a limited window to strengthen cyber defenses."

"In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable."

"Today's AI advances are already giving defenders new ways to fix weaknesses that have accumulated for years. If we act decisively, we can use the defenders' window to make our digital world much more secure."

So: attacks are about to get more common and more capable, but the same technology gives defenders a head start, if everyone moves now. The letter then names what has actually left systems exposed. Read this list slowly, because none of it is futuristic:

"Longstanding bugs, excessive permissions, misconfigurations, insecure and unpatched software, weak authentication, and technical debt in legacy systems have left systems exposed."

No mention of super-viruses or unstoppable AI hackers. The world's largest technology companies, asked to name the problem, named the fundamentals: unpatched software, weak logins, things exposed that shouldn't be. If you've been reading this series, that list should feel familiar. It's the same one that shows up in every case we've written about, from the ransomware agent that walked through an unpatched flaw to the majority of exploited vulnerabilities needing no click at all.

The letter closes with three principles: "status quo security won't be enough," "empower more defenders with cyber-capable AI," and "mobilize a collective response." The full text is on openai.com.

Who signed the OpenAI cyber defense letter

156 organizations as of 3 September 2026. Here are the names you're most likely to recognize, grouped loosely by what they do. The page accepts new signatories, so the list keeps growing; the complete, current list is on openai.com.

AI labs and model companies: OpenAI, Anthropic, Hugging Face, Perplexity, Replit, Lovable and others.

Cloud, chips, and global tech: AWS, Google, Microsoft, Oracle, IBM, Dell, HPE, Cisco, Broadcom, Elastic and other companies in the tech and telecom industry.

Security vendors: CrowdStrike, Palo Alto Networks, Fortinet, Check Point and several other companies in our industry.

Payments, banks, and finance: Visa, Mastercard, PayPal, Block, Circle, Capital One, Citi, Fiserv and several other banks and financial services providers.

E-commerce, SaaS, and developer platforms: Shopify, GoDaddy, Vercel, GitHub, Atlassian, Figma, Adobe and others.

Consulting and IT services: Accenture, Capgemini, Cognizant, KPMG, PwC and many others.

What it asks companies to do, translated for a 20-person online store

The letter addresses four groups. Governments, security vendors, and AI labs get their own homework: funding, threat-intelligence sharing, making AI-powered defense accessible to defenders with limited budgets. But the first group addressed is every organization, and that section is the one worth your attention. Condensed, it asks each business to:

• Make cyber defense a leadership priority and treat it with the urgency of an incident, not a someday project.
• Fix the highest-risk weaknesses first, and verify the fixes actually worked.
• Build in least privilege and strong access controls, so each person gets only the access they need.
• Raise the bar for what you buy, build, and deploy, including AI-generated code.
• Use AI to get broad security coverage at lower cost, saving the heavy tools for the hardest problems.

If that sounds like a to-do list written for a company with a security department, it translates cleanly to a store without one: know what you have exposed, patch what faces the internet first, put MFA on every login that matters, give people only the access they need, and have someone watching.

Not sure how your team would do against the attacks the letter describes? Run a free phishing test for employees and get a per-person report the same day.

Our honest take

Two things can be true at once, and this letter is both.

It's self-interested. AI companies calling for AI-powered defense are also describing their product roadmap. Fair enough. We're also an AI-native security company, so the same caveat applies to us, and you should weigh our enthusiasm accordingly.

And it's correct. The threat trajectory the letter describes is the one we've been documenting from public data all year: attacks industrializing, the skill floor dropping, the window between a flaw's disclosure and its exploitation shrinking. When the companies that build the models, run the clouds, and process the world's payments jointly say the status quo won't be enough, that's not marketing consensus, because these signatories don't share marketing departments. It's the rare kind of agreement that only forms around something everyone's data already shows.

The part we'd underline for you is the letter's quiet admission: the fix for an AI-accelerated threat is not exotic. It's the fundamentals, done urgently, verified, and, for teams without a security department, done with help. That's the entire premise this series has argued one article at a time, and it's now co-signed by more than 150 companies that rarely agree on anything.

Frequently asked questions

I don't use AI tools in my business. Should I worry about this? Yes, because the letter is about attackers using AI, not about you using it. AI lowers the cost of finding and exploiting the weaknesses on the list above, and it finds them wherever they are. A store that has never touched an AI tool but runs an outdated plugin or an admin login without MFA is exactly the kind of target that just got cheaper to hit. Whether you use AI changes nothing; whether your doors are closed changes everything.

Is the OpenAI cyber defense letter binding? No. It's an open letter of principles and calls to action, not a treaty, standard, or regulation. Signing is a public commitment to its principles and to the actions it describes, not an enforceable obligation.

Why are so many companies signing this letter? Three reasons, and they overlap. The threat is moving fast and the next attacks are hard to predict, so acting together is the safer bet. The data is shared: every large security and cloud company sees the same acceleration in its own telemetry. And a collective signature is a lever: it pushes governments to fund defenders and helps under-resourced organizations get access to support.

Did Anthropic, Google, and Microsoft sign? Yes, all three, alongside AWS. See the current list of signatories on openai.com.

What does "a global surge in cyber defense" mean in practice? For governments and vendors: funding, shared threat intelligence, and hands-on help for essential services. For an ordinary business: the "every organization" list above, which is a fundamentals checklist, not new technology.

Where should I start? Where the letter does: with the highest-risk weaknesses, verified. For an online store that means, in order: find out what you actually have exposed to the internet; put multi-factor authentication on every login that matters; update the platform, the plugins, and anything internet-facing; and test how your team reacts to a phishing email. If you don't know where to begin with the first step, that's exactly what the exposure scan below is for.

For your IT team. The letter's "every organization" section is a usable checklist: prioritized remediation of highest-risk exposures with verification, least-privilege and strong-authentication rollout, procurement standards that include AI-generated code review, and compensating controls where patching would disrupt operations. We keep the technical version of this playbook for whoever owns that side of your stack. See what we'd check →

---

The letter says to start by fixing the highest-risk weaknesses — finding yours is the first step of every Confidanti engagement. Talk to us.