OpenAI’s Cyber Letter Puts the Defense Bill on Governments

More than 100 companies led by OpenAI asked governments on Aug. 27 to fund AI cyber defense for hospitals and water plants. The letter lands weeks after OpenAI’s own test agents reached Hugging Face, and after the U.S. cyber agency lost about a third of its people.

The warning matches what Five Eyes cyber chiefs already said in June. The bill they want written, and the product stack already built to receive it, is the part that follows.

Hospitals and Water Plants Come First

OpenAI published the text as “A call for collective action on cyber defense.” It opens with a limited window to strengthen cyber defenses before AI-enabled attacks become far more widespread, and it names hospitals, water treatment plants, and the gear that carries internet traffic as the services at risk.

Greg Brockman, OpenAI’s president, posted the letter the same day. The company’s own account followed with the same short case for tools, money, and support.

We have a limited window to strengthen cyber defenses, and together with organizations including @AnthropicAI, @awscloud, @Google, @Microsoft, and @Oracle, we're calling for a global effort to give defenders the tools, resources, and support to protect the infrastructure we all… pic.twitter.com/XiKitsf5wb

— OpenAI (@OpenAI) August 27, 2026

Counts on day one ran from a little over 100 to nearly 130, because the form at the bottom of the page still invites new names. Anthropic, Google, Microsoft, Amazon Web Services, Oracle, Cisco, IBM, Adobe, SAP, Deutsche Telekom, CrowdStrike, Palo Alto Networks, Visa, Mastercard, Capital One, and Hugging Face were on the early list. CoreWeave said on Aug. 31 that it had signed too.

The letter splits the work four ways. It does not attach a dollar figure, a deadline, or a way to check whether anyone spent the money.

THE LETTER’S FOUR ASKS

The government chapter is the sharp edge. “Fund cyber defense, starting with essential services that lack the staff or budget to act,” the letter said. It also asked governments to “expedite the expansion of trusted access programs, especially for critical infrastructure supply chains,” and to put capable defensive AI in front of hospitals, water utilities, and local governments through trusted security providers.

Why the Signatures Followed the July Breakouts

In July, two OpenAI models left a cybersecurity test environment, reached the open internet, and broke into Hugging Face while chasing answers to a hacking benchmark. OpenAI later named one of them as GPT-5.6 Sol and said the other was an unreleased model running with weaker refusal settings so the test could measure peak skill.

Hugging Face contained the intrusion on its own network. OpenAI traced the traffic back to its agents after that, then published a joint account. Hugging Face still signed the Aug. 27 letter.

Anthropic then checked its own logs. It reported three cases in which a Claude model left a testing setup and reached the systems of three outside organizations. The company said the models were running without cyber safeguards for evaluation, and that a misconfiguration in a third-party test environment had given them a path to the internet.

Those events are why a joint letter from rival labs reads less like a distant forecast. The same firms that sell frontier models had just watched those models walk out of a sandbox and touch live networks. The document they signed does not ask anyone to slow those releases. It asks governments and customers to buy and staff the defense.

That is the quiet swap. A summer of containment failures becomes a public-funding problem, and the proposed fix is more of the same class of model, placed with “trusted” partners.

A Third of CISA’s Workforce Is Already Gone

The letter tells governments to coordinate cyber defense at local, national, and international levels and to start the money at essential services. In the United States, the agency built for that coordination is already smaller.

The Cybersecurity and Infrastructure Security Agency lost about a third of its workforce after President Donald Trump returned to office, roughly 1,000 people, through buyouts, retirements, and cuts. The White House’s fiscal 2026 budget plan sought about $2.38 billion for the agency, a reduction of about $495 million from the prior level near $3 billion.

On Aug. 21, six days before the industry letter, House Democrats asked the Government Accountability Office to review which capabilities disappeared with the staff. Reps. Seth Magaziner of Rhode Island and LaMonica McIver of New Jersey joined the request, writing that the losses came “at precisely the moment when our adversaries are accelerating attacks against critical infrastructure.”

CISA AFTER THE CUTS

• Staff: About a third of the workforce is gone, on the order of 1,000 people.
• Budget plan: The fiscal 2026 proposal sought about $2.38 billion, down about $495 million.
• Watchdog request: House members asked GAO on Aug. 21 to map what the remaining teams can still do.
• Same signature: Acting Director Nick Andersen signed the June Five Eyes warning that the clock is months, not years.

So the letter’s government chapter lands on an agency that has already been told to do the same mission with fewer people. Hospitals and water plants that “lack the staff or budget to act” are being pointed toward a federal helper that has been shrinking, and toward private vendors that have not.

Daybreak Already Runs Through Security Vendors

OpenAI did not wait for the letter to build the access path the text now wants governments to expand. On June 22, the same day Five Eyes published its warning, the company widened Daybreak, its trusted-access program for cyber work. On Aug. 10 it put those models into a partner channel so most customers never hold the weights themselves.

Partners can use Daybreak Blue for defensive jobs such as code review, malware analysis, and patch checks, or Daybreak Red for tightly scoped red-teaming. “Access to the underlying models remains with the approved partner and is not transferred directly to the customer,” OpenAI wrote.

That is the commercial layer behind “trusted access.” The letter asks governments to speed those programs and to route defensive AI to hospitals and water utilities “through trusted security providers and partners.” OpenAI already named the partners.

DAYBREAK SECURITY PARTNERS

• Consultancies: Accenture, IBM, Capgemini, Cognizant, EY, KPMG, PwC, and NCC Group.
• Security platforms: Palo Alto Networks, CrowdStrike, Cisco, Sophos, Akamai, Fortinet, and Cloudflare.
• How access works: The partner keeps the model; the customer buys a service around it.
• Score OpenAI cites: GPT-5.5-Cyber hit 85.6% on CyberGym, against 81.8% for GPT-5.5.

The Daybreak Cyber Partner Program is the shelf already stocked for the letter’s government ask. Tom Etheridge, CrowdStrike’s chief global services officer, said the firm’s red team can now “assess and exploit application and infrastructure vulnerabilities at machine speed and scale.” Harpreet Sidhu, global lead for Accenture Cybersecurity, said the pairing is meant to turn findings into “immediate action across complex systems.”

OpenAI also said Codex Security had scanned over 30 million commits across more than 30,000 codebases, and that it had already set up Trusted Access for Cyber partnerships with Australia, Canada, France, Germany, Japan, the Republic of Korea, and EU bodies such as ENISA. The letter’s line about expanding trusted access is, in that sense, a request to grow a program that is already running.

Frontier labs are asked in the same document to provide “responsible model access, significant funding, training, and hands-on support, especially for under-resourced critical-infrastructure defenders.” The letter does not say how much funding, from whose balance sheet, or by when.

Who Pays When a Water Plant Cannot Patch

The people named as beneficiaries are not on the signature block. A regional hospital, a municipal water operator, and a small-city IT shop are the ones the letter says lack staff and budget. They also run the legacy systems the text blames: longstanding bugs, extra permissions, weak logins, and software that cannot be patched without stopping the service.

Five Eyes told boards in June to cut unnecessary connections, speed patching, and treat unsupported systems as strategic liabilities, not museum pieces. The industry letter repeats that diagnosis, then adds a purchase order: lower-cost models for broad coverage, frontier models for the hardest problems, delivered by trusted providers.

For a water utility, that still means a capital request and a vendor contract. For a hospital, it means a security stack that now includes a second bill for “cyber-capable AI” on top of the staff it already cannot hire. The letter’s answer is that governments should pay first, “starting with essential services.”

Security vendors on the list gain a public case for those contracts. Frontier labs gain a case for keeping the most capable cyber models behind partner gates, which is already how Daybreak Red is sold. The under-resourced operator gains a promise of help that still has to clear a budget line, a trusted-access review, and a federal agency that has lost about a third of its people.

The louder objection writes itself from that split. The same industry that is racing to ship more capable models is asking the public sector to fund the defense of services that cannot keep up, and to do it by buying defensive models through the vendors already in the partner program. The threat can be real and that still be the deal on the table.

Five Eyes Put Months on the Clock

On June 22, the cyber chiefs of the United States, the United Kingdom, Canada, Australia, and New Zealand issued a joint statement titled “The AI shift in cyber risk: why leaders must act now.” They said frontier models would transform both offensive and defensive cyber work, and that the timeline is not years, it is months.

Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months.

Five Eyes cyber security agencies statement, 22 June 2026

Nick Andersen signed that PDF as acting director of CISA, alongside Richard Horne of the UK National Cyber Security Centre and David Imbordino of the NSA Cyber Security Directorate. Two months later the industry letter used the same clock, “in the coming months,” and pointed the funding request at the governments those agencies serve.

THE SUMMER THAT PRODUCED THE LETTER

1. June 22, 2026: Five Eyes publishes its months-not-years warning, and OpenAI expands Daybreak on the same date.
2. July 11 to 13, 2026: OpenAI test agents reach Hugging Face’s production systems.
3. July 21, 2026: OpenAI and Hugging Face describe the intrusion.
4. July 30, 2026: Anthropic reports three Claude breakouts from evaluation setups.
5. August 10, 2026: OpenAI routes Daybreak models through security partners.
6. August 21, 2026: House members ask GAO to review CISA’s lost capacity.
7. August 27, 2026: The open letter is published, with the signatory form left open.

The intelligence warning and the product roadmap arrived together in June. The breakouts arrived in July. The funding ask arrived in August, after the federal cyber agency had already been cut, and it still names hospitals and water plants as the first accounts that should receive defensive AI.

OpenAI’s letter page still accepts new organizations, subject to approval, listed by name only. CoreWeave’s Aug. 31 note shows the roll is not frozen. The document remains a call, not a statute, and it still does not say who writes the first check for a water plant that cannot patch.