The signatories include OpenAI, Anthropic, Google, Microsoft, AWS, Cloudflare, CrowdStrike, Cisco, IBM, Okta, Palo Alto Networks, Red Hat, Trail of Bits, Visa, Mastercard, banks, insurers, infrastructure companies and a pretty large portion of the cybersecurity industry.

That alone makes this notable.

These companies are collectively saying something fairly blunt:

The existing security baseline is not going to be enough for what is coming.

The letter warns that AI-enabled attacks are likely to become much more widespread and sophisticated over the coming months as increasingly capable models become available around the world.

It specifically calls out hospitals, water systems and internet infrastructure as examples of what is at risk.

This could easily be dismissed as AI companies creating a problem and then announcing that everyone needs to buy AI to solve it.

There is certainly some self-interest here.

That does not make the underlying security problem imaginary.

We have already started seeing what happens when agents are given enough tools, credentials and autonomy to interact with real systems.

OpenAI's recent Hugging Face incident is probably the clearest warning so far.

Agents escaped the assumptions of their testing environment, communicated in ways the researchers did not expect, interacted with external systems and created an incident that OpenAI itself now describes as a warning about where increasingly autonomous systems are heading.

A day later, a huge collection of AI, cloud and security companies is telling everyone that we need to raise the security bar.

I don't think those events are unrelated.

Security assumptions designed around humans are starting to break

Most of our security infrastructure was built around people and relatively predictable software.

A human logs in.

A service account runs one application.

An API key belongs to one integration.

A workload receives a credential.

An administrator grants a set of permissions.

Rate limits and monitoring assume some reasonably understandable relationship between identity, intent and activity.

Agents make all of that messier.

An agent can operate continuously.

It can perform thousands of actions.

It can create or coordinate with other agents.

It can discover tools dynamically.

It can encounter malicious instructions.

It can make decisions nobody explicitly programmed.

And increasingly, it can act quickly enough that a human cannot realistically review every step.

That means "the user authenticated successfully" is nowhere near enough information anymore.

We need to know:

which agent is this?

who authorized it?

what is it allowed to do?

what authority was delegated to it?

can it delegate that authority again?

what resources can it access?

how long does that authority last?

what actually performed this action?

This is the same issue I keep coming back to when thinking about agent identity and delegation.

The industry is now starting to say the same thing from the security side.

The open letter specifically asks frontier AI companies to make agent identities traceable and accountable.

That is a much more important requirement than it may initially sound.

An autonomous agent should not simply inherit a person's credentials and become indistinguishable from that person.

If an agent deletes something, changes a firewall rule or deploys software, I should be able to determine that the agent performed the action on my behalf.

And the agent should have only the authority necessary to perform its job.

Least privilege becomes considerably more important with agents

The letter calls for organizations to move toward stronger access controls, least privilege and defense in depth.

None of those ideas are new.

That may actually be the point.

AI is about to make decades of security shortcuts much more expensive.

An administrator with excessive privileges is dangerous.

An API key with excessive privileges is dangerous.

An autonomous agent holding those same privileges and capable of trying thousands of things while nobody is watching is something else entirely.

The same applies to old software, weak authentication, forgotten services and systems that have never been patched because nobody thought attacking them was worth the effort.

AI changes the economics.

Vulnerability discovery becomes cheaper.

Reconnaissance becomes cheaper.

Writing exploits becomes cheaper.

Trying thousands of attack variations becomes cheaper.

Operating many attacks simultaneously becomes cheaper.

The vulnerabilities may already exist.

What changes is how inexpensive it becomes to find and exploit them.

That is why I find the letter's phrase "status quo security won't be enough" more interesting than the usual warnings about rogue AI.

The companies signing this aren't saying we need one clever new AI firewall.

They are saying a lot of things we already know how to do need to become considerably more rigorous.

Least privilege.

Strong authentication.

Patching.

Isolation.

Observability.

Incident response.

Secure software.

Threat intelligence.

And eventually better standards for identifying and constraining autonomous agents.

This needs standards, not another hundred proprietary agent security systems

This is where I hope the industry gets it right.

Every cloud provider, AI company and security vendor could invent its own mechanism for identifying agents and describing what they are allowed to do.

That would be a disaster.

An agent may interact with dozens of services operated by completely unrelated companies.

Identity and delegated authority need to survive those boundaries.

I should be able to authorize an agent to perform a narrow role without giving it my entire identity everywhere it goes.

Services should be able to verify that authority without trusting whatever natural-language description the model happens to provide.

And security systems should be able to trace actions back through the delegation chain.

That needs boring, interoperable standards.

OAuth.

Workload identity.

Proof-of-possession credentials.

Token exchange.

Short-lived credentials.

Machine-readable authorization.

Auditable delegation.

Whatever the final architecture becomes, I hope we extend infrastructure we already understand rather than build an entirely separate security universe specifically for AI.

The recent MCP roadmap is already moving in that direction with workload identity, DPoP and agent delegation.

Now the broader security industry is explicitly calling out the same class of problem.

That convergence is notable.

The defenders get AI too

There is another part of this I agree with.

The letter is not calling for organizations to defend against AI using only the security tools we have today.

It argues that defenders need access to capable AI too.

That makes sense.

If attackers can use agents to inspect millions of lines of code, defenders should be able to do the same thing looking for vulnerabilities.

If attacks operate continuously, defensive monitoring needs to operate continuously.

If offensive systems can rapidly explore thousands of possible attack paths, defensive systems should be able to investigate and close those paths at similar speed.

Humans still need to define the security boundaries and decide what matters.

But expecting human security teams to manually keep pace with autonomous offensive systems seems unrealistic.

The defensive side is going to become increasingly agentic too.

Which brings us straight back to the original problem.

Those defensive agents will also need identities.

They will also need permissions.

They will also need isolation.

They will also make mistakes.

And some of them will inevitably be compromised.

We are not just entering a world where AI attacks computers.

We are entering one where AI systems on both sides increasingly interact with each other through the infrastructure we depend on.

The security architecture underneath that needs to be considerably stronger than "here is an API key, please don't do anything bad."

More than 100 of the companies building that future are now publicly saying so.

That seems like a significant moment.

Read the open letter, "A call for collective action on cyber defense."

Read the Slashdot coverage.

All notes