100+ AI firms warn U.S.

More than 100 companies have now put their names to a coordinated warning that AI-enabled cyberattacks are likely to intensify and that governments and businesses need to move faster on defenses. The public push took shape in an August 27 open letter signed by 116 entities, including OpenAI, Anthropic, Microsoft and Advanced Micro Devices, according to CNBC and Axios. (cnbc.com) The signatories said organizations should “act decisively” to raise cyber defenses as increasingly capable AI systems lower the cost and speed up the execution of attacks. They also called for public support to help under-resourced critical infrastructure such as hospitals and water treatment plants improve their defenses. (nist.gov) This is not just a generic “AI risk” warning. The letter’s focus is operational: deploy better defensive tools, upgrade security systems, and make those protections available beyond the biggest technology companies. The signatories’ message lands alongside official work at the U.S. National Institute of Standards and Technology and Britain’s National Cyber Security Centre on how to secure more autonomous “agentic” AI systems. ### Why are the companies warning now? The August 27 letter says the industry has a “limited window” to strengthen defenses before AI-enabled attacks spread more broadly. CNBC reported that the 116 signatories included technology firms, cloud providers, cybersecurity companies and other entities, and that they urged every organization to “raise the security bar” on defense tools. (cnbc.com) Axios described the effort as an open letter from OpenAI, Anthropic and Microsoft warning of growing AI cyberattacks and calling on governments and technology companies to act now. The core point is that the same advances making AI systems more capable for legitimate users can also help attackers automate reconnaissance, phishing, vulnerability discovery and other parts of the intrusion chain. (cnbc.com) ### What did the signatories actually ask for? The clearest ask is faster, broader deployment of cyber defenses. CNBC reported that the group urged organizations to upgrade security systems and use a mix of low-cost and frontier AI models for defense. (cnbc.com) It also said the letter called for a coordinated government effort to fund cyber defense and improve access for under-resourced critical infrastructure operators. That matters because the letter did not frame the issue as one only for model developers. The signatories included companies from cloud, semiconductors, finance and cybersecurity, according to CNBC, suggesting the campaign is aimed at both policymakers and operators of essential systems. (axios.com) ### Where do NIST and the NCSC fit into this? NIST has already launched an AI Agent Standards Initiative focused on making autonomous AI systems more secure and interoperable. The agency says the initiative covers industry-led standards, community protocols, and research into agent authentication and identity infrastructure for secure human-agent and multi-agent interactions. NIST also points to a draft concept paper on software and AI agent identity and authorization. (cnbc.com) The NIST concept paper is more specific about the security plumbing. It says agentic AI adoption depends on applying identification, authentication and authorization principles to agents, and that the project is intended to reduce implementation risk by showing how existing identity standards can be used in agentic architectures. (cnbc.com) ### What does the British guidance say about agentic AI risk? The U.K. National Cyber Security Centre has published interim guidance titled “Managing the cyber risk of agentic AI.” The document says organizations should use safeguards, sandboxing and active oversight, and it warns that increasingly autonomous systems can carry out unsanctioned or unintended activity if they are not properly constrained and monitored. (nist.gov) The NCSC guidance also lays out concrete controls: assess how much autonomy is needed, understand built-in safeguards, control the agent’s environment with a robust sandbox, log and monitor activity, make actions attributable, and maintain an emergency shutdown capability. (nccoe.nist.gov) Those points line up with the broader emphasis in the industry letter on practical defenses rather than abstract AI principles. ### What should readers watch next? NIST’s AI Agent Standards Initiative page says its related work includes requests for input on agent security and identity, while the NCCoE concept paper says community feedback will shape later project planning and possible collaboration calls. (ncsc.gov.uk) The NCSC, for its part, says its current agentic AI advice is interim and will be followed by more formal guidance. The next concrete markers, then, are not speeches but documents: updated NIST standards work on agent identity and authorization, and future NCSC formal guidance on securely deploying increasingly autonomous AI systems. (nist.gov) (ncsc.gov.uk)