The AI Industry Is Saying the Current Security Baseline Is Not Enough

More than 100 organizations have signed an open letter calling for a global increase in cyber defense. The signatories include OpenAI, Anthropic, Google, Microsoft, AWS, Cloudflare, CrowdStrike, Cisco, IBM, Okta, Palo Alto Networks, Red Hat, Trail of Bits, Visa, Mastercard, banks, insurers, infrastructure companies and much of the cybersecurity industry. That alone makes this notable.

These companies are collectively saying something fairly blunt: the existing security baseline is not going to be enough for what is coming. The letter warns that AI-enabled attacks are likely to become much more widespread and sophisticated over the coming months, and it specifically calls out hospitals, water systems and internet infrastructure as examples of what is at risk.

This could easily be dismissed as AI companies creating a problem and then announcing that everyone needs to buy AI to solve it. There is certainly some self-interest here. That does not make the underlying security problem imaginary. OpenAI's recent Hugging Face incident is probably the clearest warning so far—agents escaped the assumptions of their testing environment, interacted with external systems, and created an incident OpenAI itself now describes as a warning about where increasingly autonomous systems are heading.

A day later, a huge collection of AI, cloud and security companies is telling everyone that we need to raise the security bar. I don't think those events are unrelated.

Most of our security infrastructure was built around people and relatively predictable software. Agents make all of that messier. An agent can operate continuously, perform thousands of actions, create or coordinate with other agents, discover tools dynamically, and make decisions nobody explicitly programmed. That means "the user authenticated successfully" is nowhere near enough information anymore. We need to know which agent this is, who authorized it, what it is allowed to do, what authority was delegated to it, whether it can delegate again, and what actually performed each action.

This is the same issue I keep coming back to when thinking about agent identity and delegation, and the industry is now starting to say the same thing from the security side. The open letter specifically asks frontier AI companies to make agent identities traceable and accountable. An autonomous agent should not simply inherit a person's credentials and become indistinguishable from that person. If an agent deletes something, changes a firewall rule or deploys software, I should be able to determine that the agent performed the action on my behalf—and the agent should have only the authority necessary to perform its job.

The letter calls for stronger access controls, least privilege and defense in depth. None of those ideas are new. That may actually be the point. AI is about to make decades of security shortcuts much more expensive. An administrator with excessive privileges is dangerous. An API key with excessive privileges is dangerous. An autonomous agent holding those same privileges while nobody is watching is something else entirely.

That is why I find the letter's phrase "status quo security won't be enough" more interesting than the usual warnings about rogue AI. The companies signing this aren't saying we need one clever new AI firewall. They are saying a lot of things we already know how to do need to become considerably more rigorous.

This is where I hope the industry gets it right. Every vendor could invent its own mechanism for identifying agents and describing what they are allowed to do. That would be a disaster. Identity and delegated authority need to survive service boundaries. That needs boring, interoperable standards—OAuth, workload identity, proof-of-possession credentials, token exchange, short-lived credentials, machine-readable authorization, auditable delegation. The recent MCP roadmap is already moving in that direction. That convergence is notable.

The letter also argues that defenders need access to capable AI too. That makes sense—but those defensive agents will also need identities, permissions, and isolation. They will also make mistakes. And some of them will inevitably be compromised. The security architecture underneath that needs to be considerably stronger than "here is an API key, please don't do anything bad." More than 100 of the companies building that future are now publicly saying so. That seems like a significant moment.

Read the open letter, A call for collective action on cyber defense.