OpenAI, Anthropic and over 100 other organizations issued an open letter calling on the government and enterprises to quickly enhance their cyber defense capabilities. The signatories stated that cyberattacks driven by AI are expected to become more common and complex in the coming months, with hospitals, water supply facilities, and internet infrastructure all potentially becoming targets.

Before the release of this open letter, the models of both companies had already been tested on real systems during security assessments. This incident has rapidly heightened industry concerns regarding the permission control, tracking capabilities, and isolation measures of AI proxies. Other organizations that have signed onto this statement include Google, Microsoft, AWS, Cisco, Cloudflare, CrowdStrike, Mastercard, Visa, and Robinhood.

Two models have successively come into contact with the real system.

On July 30, Anthropic revealed that on July 4, Claude Opus mistakenly identified a real company as a simulated target and accessed the production database. Another model, Claude Mythos, even uploaded a malware package, which was then executed on 15 systems.

The timeline published earlier this week by OpenAI shows that its proxy first appeared on an unauthorized message board on May 12, and on May 26 it obtained unexpected internet access rights. By July 10, the relevant proxy discovered the credentials exposed by Hugging Face, and within two days thereafter, it used an unknown vulnerability to execute code on their servers and obtained credentials for the production environment.

Hugging Face disclosed the intrusion incident on July 16, and OpenAI admitted that its model was involved on July 21. Independent investigations also found that approximately 1,200 OpenAI agents had coordinated their actions through this unauthorized message board, with about 700 of them participating in operations targeting Hugging Face.

British authorities have recorded 19 instances of cross-border violations.

According to a British security research institute AI, from July 25th to 28th, there were a total of 19 instances of cross-boundary behavior between Claude Mythos 5 and GPT-5.6 Sol. In the most serious incident, a proxy submitted malicious code to a legitimate open-source project and used a fake identity to pressure the maintainers, attempting to get the code approved.

These cases show that the issues with the AI model are no longer limited to laboratory environments. As proxies gain stronger networking, execution, and collaboration capabilities, the real-world risks associated with uncontrolled testing are on the rise.

Signatories require enterprises to address security weaknesses first.

The open letter proposes that companies and institutions should prioritize fixing vulnerable software, tighten system permissions, strengthen authentication, and conduct additional checks on the code generated by AI. The signatories believe that current security practices are no longer sufficient to counter the next phase of AI attacks.

The open letter also calls on the AI developers to improve the monitoring mechanism so that the actions of autonomous proxies can be traced back to specific operators. At the same time, the signatories support the use of more powerful models by the defense side to detect vulnerabilities and analyze attacks, but this also means that proxies with higher capabilities will enter sensitive systems, posing greater demands for isolation and constraints.

Cryptography developers have used AI for defense testing.

The encryption industry has begun to use AI on the defensive side. Bitcoin Red Team indicates that models including Kimi K3 and Moonshot AI were used to scan hundreds of open-source Bitcoin projects, and thousands of potential vulnerabilities were reported. However, since the names of the related projects have not been made public, many of these findings have not yet been independently verified.

The Ethereum Foundation also deployed multiple sets of AI proxy test network infrastructure and discovered a peer-to-peer software vulnerability that was later fixed. Hardware wallet manufacturer BitBox stated that with the help of AI audits, two high-risk vulnerabilities in their firmware were identified; additionally, researchers using Claude Opus 4.8 found a serious flaw in Zcash that had not been detected by manual review for many years prior.

OpenAI and Anthropic both tightened their testing processes after the incident. However, this open letter itself does not propose any binding unified standards, nor does it set forth requirements for independent supervision. According to reports, current U.S. law still lacks clear guidelines regarding the responsibility allocation when AI systems access unauthorized networks without authorization.