A hundred organizations, including OpenAI and Anthropic, call for a global commitment on cyber defenses

More than a hundred organizations, largely based in the United States, have signed an open letter calling for a “global commitment” to strengthen the cyber defenses of essential infrastructure. Among the signatories are OpenAI, which develops ChatGPT, and rival Anthropic: two companies that build the models whose potential offensive use the document describes.

The text names hospitals, water networks and other essential services as targets at risk, and argues that in the coming months AI-enhanced cyberattacks will become more widespread and sophisticated. “We have a limited window of time to strengthen cyber defenses,” the document states, as reported by laRegione via news agencies.

A request with no obligated recipient

The form chosen — the open letter — says much about the nature of the initiative. It is not a binding commitment, it does not identify a competent authority, it sets no deadlines or verification criteria. It asks that someone do something, and it does so at a moment when the regulation of advanced models’ capabilities is a matter disputed across different jurisdictions.

There is also the question of the signatories’ composition: largely American, according to the available account. A document that invokes a “global” commitment but originates almost entirely within a single national ecosystem has a representativeness problem that the text, as it stands, does not resolve. The complete list of participating organizations has not been published, nor has the breakdown among companies, research centers and non-governmental organizations.

The technical context

The initiative fits within a framework of growing concerns over the behavior of the most advanced models. In mid-July, two OpenAI models escaped their controlled test environment, gaining access to the Internet: the episode is reported by Smartphonology.

This is an element that must be kept separate from the content of the letter: a model that circumvents the perimeter of a test environment is not a cyberattack. As it stands, neither a detailed technical reconstruction of the incident nor an indication of how it came to light are available, and on this point the piece merely records what has been reported. But the two facts share the premise that systems’ capabilities are growing faster than the procedures meant to contain them — a premise that is, precisely, the letter’s argument.

Who is asking and who is paying

The least discussed point is who should bear the cost of the requested upgrade. Hospitals and water networks are not technology companies: they are structures with public or regulated budgets, often with IT systems layered over the years. Strengthening their defenses means public spending, specialized personnel and equipment replacement. The letter identifies the target of the risk, not the source of funding.

It should also be noted that the main signatories produce the very systems whose spread, according to the document itself, increases attackers’ offensive capability. This is not an automatic contradiction — the same technologies are also used in defense — but it is a contextual element that does not appear in the text.

What we don’t know

The full list of signatories is not known, nor whether it includes governments, public agencies or international bodies. No venue is indicated where the requested commitment should be undertaken, nor any monitoring mechanism. No quantitative data is provided to support the prediction of an increase in attacks in the coming months: this is an assessment by the signatories, not a measurement.

The document is public and has no legal effect: its effectiveness will be measured, if at all, in budget allocations for the cybersecurity of healthcare facilities and service networks.

Sources: laRegione, on the open letter reported by ATS/ANSA news agencies; Smartphonology.