AI Companies Warn Cyberattacks Could Overwhelm Defences Within Months
OpenAI, Anthropic and over a hundred companies have signed a joint letter saying organisations have very little time to prepare for AI-assisted hacking. Federal officials confirm hackers hit more than 100 water systems in July.
Key points
- OpenAI, Anthropic and more than 100 companies co-signed a letter in 2025 warning that AI-enabled cyberattacks are likely within months.
- CISA reported malicious hacking activity targeting more than 100 water and wastewater systems in July 2026.
- Hackers are using AI to help write scripts that attack industrial control devices connected to the internet.
- The letter calls on governments to give hospitals and water utilities access to defensive AI tools.
- The letter contains no specific funding commitments or named investments.
More than 100 technology companies, co-signed by OpenAI and Anthropic among others, have put their names to an open letter warning that AI-powered cyberattacks aren't a distant threat. They could arrive within months.
The letter calls for a "collective response" and asks every organisation to make cyber defence an "immediate leadership priority." Governments are urged to give hospitals, water systems and local bodies access to capable defensive AI, and to "impose costs" on attackers.
One catch: as Axios noted, the letter contains no specific spending commitments or named investments. It's a call to arms without a named general.
Why should ordinary people care?
The targets aren't banks or tech firms. They're the places people depend on every day.
The U.S. Cybersecurity and Infrastructure Security Agency, the federal body that monitors threats to critical national systems, reported that hackers had targeted more than 100 water and wastewater systems across the country in July alone. We first covered CISA's activity on this beat on 15 July 2026, and the agency has featured in six of our stories since.
Attacks focused on programmable logic controllers, small computers that monitor and manage physical equipment such as pumps and valves. Many water utilities connected these devices to the internet years ago so staff could check readings remotely. That convenience is now a vulnerability.
Federal officials say attackers are using AI to write the attack scripts, lowering the skill required to cause real damage. Wired reported earlier this year that a leaked industry memo tied this surge to Iran-linked actors.
What does the AI warning letter actually mean?
Taken at face value, it's an acknowledgement from the companies building the most powerful AI systems that those same systems will be weaponised against ordinary infrastructure faster than most governments are ready for. Our story on 27 August covers the full list of signatories and what each major firm said.
The ask is clear enough: fund defensive AI, protect vulnerable sectors, treat this as urgent. Whether that produces action depends entirely on the governments being addressed.
For now, it's a statement of concern, not a plan.
What should people watch for?
If you work at a hospital, school or utility, the risk picture has changed. AI tools make it cheaper for attackers to craft convincing phishing emails (fake messages designed to steal passwords), to probe for weaknesses, and to automate attacks that once needed skilled human effort.
Knowing how to spot a phishing attempt matters more now than it did two years ago. Check that your organisation runs regular security-awareness training. If it doesn't, push for it.
And if your tap runs dry or a local service goes dark without explanation, a cyberattack on industrial control systems is no longer a fringe possibility.
