August 29, 2026. On August 27, more than 100 companies published an open letter titled A Call for Collective Action on Cyber Defense, warning there is a limited window before AI enabled cyberattacks become far more widespread and sophisticated in the coming months. The coverage leads with hospitals and water utilities, but the letter's first action list is addressed to every organization, and most of it reads like the checklist a typical agency, e-commerce store, or 20 person SaaS team has been postponing for years. When the companies running your storefront, your DNS, and your deploy pipeline all sign a statement expecting machine speed attacks within months, the small businesses standing on top of them are the soft targets.
What the Letter Asks Every Organization to Do
- Make cyber defense a leadership priority with incident level urgency: fix the highest risk weaknesses first, verify the fixes, and raise the security bar for everything you buy, build, and deploy, explicitly including AI generated code.
- Rebuild around least privilege, strong access controls, and defense in depth instead of patching around legacy permissions and old misconfigurations.
- Use capable, lower cost AI models for broad security coverage and reserve frontier models for the hardest problems, an unusually specific budgeting instruction for an open letter.
- For the AI companies themselves: build observability tooling and ensure agentic identities are traceable and accountable, the same governance language that followed this summer's Hugging Face incident.
Who Signed, and Why the List Matters to SMBs
CNBC counted 116 entities at publication, and the list has kept growing since. Beyond the expected security vendors sit the platforms small businesses actually run on: Shopify, GoDaddy, Cloudflare, Vercel, Figma, Replit, and Lovable, alongside Mastercard, Visa, major banks, and insurers. That mix is the operator tell. Your store platform, your registrar, your CDN, and your site builder are collectively preparing for an attack surge, which means the exposure they see is flowing through the products you use every day. Not everyone is applauding: Engadget's write up called the letter too little too late from the same companies whose models created the risk, and there is a real marketing scent to warnings that double as demand generation for AI security products. Both readings can be true, and neither changes what a small operator should do next.
What It Means for Operators
Three moves this quarter. First, do the unglamorous basics the letter keeps circling: multi factor authentication everywhere, patched software, and least privilege on every SaaS seat, API key, and integration, because AI driven attacks industrialize the exploitation of exactly those gaps. Second, put AI on defense where attackers already use it on offense: email triage and phishing detection, log review, and dependency scanning are cheap wins with the lower cost models the letter itself recommends. Third, scope your agents. If AI agents touch your inbox, CRM, or browser, treat each one like a new hire with least privilege, a monitored trail, and a human gate on consequential actions, the playbook from OpenAI's own agent incident report. We wire that governance into every AI automation we ship, and if nobody owns security on your stack, a scoped engagement with an AI engineer costs less than one successful invoice fraud. The letter's authors are talking to governments and hyperscalers, but the window they describe closes on everyone at the same time.
Frequently Asked Questions
It is an open letter published on August 27, 2026 and hosted by OpenAI, signed by more than 100 companies, warning that AI enabled cyberattacks will become far more widespread and sophisticated in the coming months. It proposes three principles: recognize that status quo security is not enough, empower defenders with cyber capable AI, and mobilize a collective response across industry and government.
Signatories include OpenAI, Anthropic, Google, Microsoft, AWS, Cloudflare, CrowdStrike, Palo Alto Networks, IBM, and Oracle, plus platforms small businesses rely on such as Shopify, GoDaddy, Vercel, Figma, Replit, and Lovable, and financial names including Mastercard, Visa, Capital One, and several major banks and insurers. CNBC counted 116 entities at publication.
Its every organization section asks leaders to treat cyber defense with incident level urgency: fix the highest risk weaknesses, verify fixes, raise the security bar for everything bought, built, or deployed including AI generated code, move to least privilege and strong access controls, and use lower cost AI models for broad coverage while applying frontier models to the hardest problems.
Both readings have support. The signatories include the companies best placed to see attack telemetry, and the letter follows documented incidents of AI agents exploiting real infrastructure. Critics, including Engadget, note the warning comes from the companies whose models created the risk and doubles as promotion for AI security products. The recommended actions are standard security hygiene either way, so the checklist is worth doing regardless of motive.