Menu
SUBSCRIBE
SUBSCRIBE
Menu

cyber defense

Abstract digital network representing organizations working together on a collective cyber defense effort.

More Than 150 Organizations Call for AI Cyber Defense Surge

, , , , , , , , ,

The coalition says hospitals, water utilities, local governments, and other essential services should receive AI security tools, funding, and hands-on support first.

 

More than 150 organizations called for a global surge in cyber defense, warning that they expect AI-driven attacks to become more widespread and sophisticated within months.

The open letter’s signatories include OpenAI, Anthropic, Google, Microsoft, Amazon Web Services, major cybersecurity companies, banks, technology providers, and consulting firms.

The letter outlines a broad, shared responsibility for businesses, governments, cybersecurity companies, technology partners, and major AI developers. It does not specify funding amounts, deadlines, or how much support individual organizations will provide.

The signatories did not cite evidence supporting their prediction that AI-powered attacks will become much more capable and widespread within months. They said existing security weaknesses, such as unpatched software and weak access controls, leave businesses and public services exposed as AI gives attackers more powerful tools.

Essential services would receive help first

The coalition called for hospitals, water utilities, local governments, and other essential services with limited security budgets to receive early support.

They call for governments to fund cyber defense for these organizations and expand programs that permit trusted security providers to test their systems. Governments should also coordinate the sharing of information about attacks and help organizations respond and recover.

The letter called on major AI companies to provide access to powerful models, funding, training, and hands-on assistance. Cybersecurity companies and technology providers should help essential-service operators deploy AI security tools, repair weaknesses, and verify that the repairs work.

These are proposed actions, not commitments that the signatories have agreed to fund or complete.

Businesses are told to treat cyber defense as urgent

The letter called on every organization to make cyber defense an immediate leadership priority and address its highest-risk weaknesses.

Companies should strengthen security standards for the software they buy, build, and use, including code produced with AI, according to the letter. They should also limit people and software to the access they need, strengthen authentication, and use multiple layers of protection.

The coalition said companies can use lower-cost AI models to check more systems for weaknesses and reserve the most powerful models for harder security problems. When essential systems cannot be patched without interrupting operations, organizations should use other safeguards and verify that those protections work.

Technology providers would share tools and attack information

The letter calls for cybersecurity companies and technology providers to continuously test whether their defenses can withstand attacks using increasingly capable AI models.

They should also share information about attacks, tested response plans, and verified repairs so that work completed by one organization can help protect others.

The letter called on major AI developers to build tools that make AI systems easier to monitor. It also said companies should be able to identify AI agents operating in their systems, review what those agents did, and determine who authorized their actions.

OpenAI is accepting applications from additional organizations that want to add their names to the letter. Submissions require approval, and accepted organizations will be listed by name.

Gov. Gavin Newsom speaks at a lectern for an article about California’s AI cyber defense program.

California Creates AI Cyber Defense Program for Critical Infrastructure

, , , , , , , ,

The state will give local governments and operators in energy, water, and transportation access to AI-assisted cyber defense capabilities.

 

California Gov. Gavin Newsom directed his administration to establish an AI cyber defense program within the California Cybersecurity Integration Center (Cal-CSIC). The program will use AI to find security weaknesses, strengthen networks, and help respond to cyberattacks. 

The program is intended to support state agencies and expand advanced cybersecurity capabilities to local governments and critical infrastructure operators.

New Program Adds AI to California’s Existing Cyber Support

Cal-CSIC already shares information about cyber threats and coordinates incident response with state and local agencies, utilities, and other public and private organizations.

The new program will add AI-assisted cybersecurity defenses, including vulnerability detection, network protection, and incident response, to that work.

Newsom also directed Cal-CSIC to expand access for local governments and critical infrastructure operators to advanced state cybersecurity capabilities, including AI-assisted defenses. The announcement names water, power, transportation, and emergency communications among the services the directive is intended to protect.

Caroline Thomas Jacobs, Director of the California Governor’s Office of Emergency Services, said, “This new program will help Cal OES and our partners detect threats sooner, share information more efficiently, strengthen defenses, and respond faster, helping keep these critical services safe and reliable for communities across California.”

Separately, every state agency must appoint an AI Cybersecurity Officer. The announcement does not specify the scope of responsibility of these newly created roles.

The new actions build on Cal-Secure 2.0, California’s existing cybersecurity roadmap for state agencies. That roadmap calls for greater use of AI-enabled security tools and stronger coordination across state government.

Blurred photo of a computer monitor showing dense multicolored code, from the UK government's AI vulnerability scanning pilot 2026.

UK Government Finds 407 Cyber Vulnerabilities Using Frontier AI

, , , , , , , , , , ,

The GC3’s month-long scanning program across nine departments uncovered critical flaws, including one that let any outsider run code on a government server by posting a comment.

 

The Government Cyber Coordination Centre (GC3), a partnership between the National Cyber Security Centre (NCSC) and the Department for Science, Innovation and Technology, published a case study on 12 June 2026 detailing a month-long series of weekly hackathons. Hacker teams used AI vulnerability scanning to review public code repositories across nine UK government organizations, working with frontier AI models including Claude Mythos and GPT-5.5. They identified 407 security flaws, including critical weaknesses that could let attackers bypass login controls, access sensitive data, or run code directly on government servers.

The most significant find: a flaw in a code repository used by a major government service that let any outsider run code directly on the government’s server by posting a comment. From there, an attacker could have used those credentials to approve code changes, reach connected systems, and remove any trace of the intrusion.

 

Teams built three distinct approaches.

  • One put each code repository through a six-stage AI pipeline, with each stage reviewing and pushing back on the conclusions of the one before it.
  • A second ran standard security scanning tools first to generate an initial list of potential issues, then used AI to trace how those issues could be chained into an actual attack.
  • A third built five custom AI tools that turned a complex audit across hundreds of services into something repeatable.

 

The GC3 drew four conclusions.

  1. Structure beats model choice. Teams that gave AI a defined job at each step consistently outperformed those using it without a clear structure.
  2. The specific AI model matters less than expected. With the right structure, slightly older models performed as well as the latest frontier ones at scanning code.
  3. AI finds potential issues faster than humans can check them. If the AI isn’t given clear boundaries on where to look, it flags far more potential issues than the security team has time to investigate.
  4. Finding vulnerabilities and fixing them are separate problems. All critical issues were patched through existing processes, but generating the actual fixes still requires human review.

 

GC3 will run a second phase with more departments, additional models, and coverage of government code that isn’t published publicly. AISI and NCSC will deepen involvement as the program moves further from controlled testing into live environments.