OpenAI and Google warn: AI hacking needs a “defensive surge”

What happened

On August 28, 2026, over 100 organizations, including major players like OpenAI, Anthropic, Microsoft, Google, AWS, NVIDIA, IBM, and Visa, released a joint open letter. This letter delivered a blunt message: AI is rapidly enhancing cyber attack capabilities, making them faster, cheaper, and significantly more difficult to detect and stop. The coalition termed this necessary response a "defensive surge."

The primary concerns highlighted by these organizations include AI's capacity to generate hyper-realistic phishing emails and texts, mimicking specific tones and writing styles to bypass traditional detection methods. They also noted AI's role in helping criminals draft and modify malicious code and probe systems at internet speeds, beyond typical human capabilities. Furthermore, the letter addressed the emerging threat of AI agents, which are AI systems capable of executing a sequence of actions, such as logging in and running scripts, if incorrectly configured.

While acknowledging AI's potential to bolster defenses by spotting unusual patterns and triaging security alerts, the letter emphasized that this joint warning serves as a public declaration. It signals that the threat is no longer hypothetical and necessitates a shift in how cybersecurity is perceived and managed, moving it from an IT task to a fundamental infrastructure concern.

Why it matters

This unified warning from a diverse group of tech giants and competitors underscores a significant shift in the cybersecurity landscape. When companies like OpenAI and Google, who often compete fiercely, collaborate on a public statement of this nature, it signals that the threat is pervasive and demands a collective, industry-wide response. It indicates that the AI models themselves, while powerful tools, also create new vulnerabilities that require urgent attention.

The implications for businesses and individuals are substantial. AI's ability to personalize persuasion in cyberattacks means that traditional indicators of malicious activity, such as grammatical errors or generic greetings, are becoming obsolete. This raises the bar for user vigilance and necessitates more robust, AI-powered defensive measures. For companies, the threat of payroll diversion, account takeovers, and deeply personal scams, now scalable to thousands of targets simultaneously, poses an existential risk to financial and reputational integrity.

This call for a "defensive surge" suggests a future where cybersecurity will be less about patching individual vulnerabilities and more about systemic resilience. It anticipates increased investment in AI-driven defenses, but also a greater emphasis on human habits and operational discipline. The message is clear: if the developers of advanced AI are warning about its misuse, the operational reality of securing digital assets must adapt rapidly to this new threat vector.

What to watch next

• Observe whether the "defensive surge" materializes into concrete, collaborative industry initiatives beyond this open letter.
• Monitor how major email providers and banks integrate new AI-powered verification and friction points into their services to combat advanced phishing.
• Track the development of AI agents and the regulatory or industry standards that emerge to prevent their misuse in cyberattacks.
• Note any public reporting or data indicating a measurable increase in AI-assisted cyber incidents or, conversely, the effectiveness of new AI-driven defenses.
• Look for changes in cybersecurity insurance policies or compliance requirements reflecting the heightened risk posed by AI-enabled threats.

What this means for you

For business leaders and operators, the core message is that human-centric cybersecurity practices must evolve beyond identifying obvious flaws. The "look for typos" era is over. The focus must shift to fundamental security habits and architectural resilience, especially concerning email, which remains the master key to most digital accounts. Investing in continuous security education that emphasizes critical thinking over rote memorization is now essential.

Practically, this means immediately reinforcing multi-factor authentication (MFA) across all critical accounts, prioritizing authenticator apps over SMS codes for email. Mandating strong, unique passwords for email accounts, possibly through password managers or long, memorable phrases, is no longer optional. Furthermore, a firm policy of directly navigating to trusted sites or calling official numbers for account inquiries, rather than clicking links in emails, must become standard operating procedure across the organization.

Key takeaways

• Over 100 organizations warned that AI is making cyber attacks faster, cheaper, and harder to stop.
• AI enables sophisticated phishing, malicious code creation, and automated system probing.
• The warning signals a need for a "defensive surge" in cybersecurity practices.
• Protecting email with strong multi-factor authentication and unique passwords is critical.
• Avoid clicking links in suspicious messages; navigate directly to official websites or apps.

What is the biggest warning about AI and cyber attacks?

The biggest warning from over 100 organizations, including OpenAI and Google, is that AI is fundamentally changing the landscape of cyber attacks by making them faster, cheaper, and significantly harder to detect and stop. This includes AI's ability to generate highly convincing phishing messages, aid in writing and modifying malicious code, and enable automated probing of systems at internet scale, leading to a call for a "defensive surge."

How does AI improve phishing attacks?

AI improves phishing attacks by enabling criminals to create messages that are grammatically perfect and mimic specific tones or writing styles, such as that of a boss, bank, or even a spouse. This personalization makes it difficult for individuals to spot fake emails or texts, as traditional indicators like typos are eliminated, dramatically increasing the effectiveness of persuasion-based cybercrime.

What are AI agents and how do they pose a cyber threat?

AI agents are AI systems capable of executing a sequence of actions, rather than just answering questions. In a cyber threat context, this means an AI agent could be instructed to perform multiple steps like logging into a system, navigating to specific interfaces, and executing scripts. This capability makes them dangerous if connected to the wrong tools or models, allowing automated and complex attacks.

What can individuals do to protect themselves from AI-enhanced cyber threats?

Individuals can protect themselves by adopting several key habits. This includes enabling multi-factor authentication (MFA) for email, preferably using an authenticator app. They should also create unique, strong email passwords, and establish a "no links" rule, meaning they should navigate directly to websites or use official apps rather than clicking links in emails. Additionally, setting a family-specific phrase for urgent requests can prevent personal scams.

Can AI also help defend against cyber attacks?

Yes, the open letter acknowledges that AI can also be a powerful tool for defense against cyber attacks. AI can help security teams by spotting unusual patterns in logins, flagging suspicious emails that human analysts might miss, and triaging the overwhelming number of security alerts to identify real threats faster. This helps prevent security teams from being "drowned in alerts."