The Cybersecurity Apocalypse Is Coming in ‘Months,’ AI Giants Warn
More than 100 technology companies, including OpenAI and Anthropic, have warned that organisations may have only months to prepare for AI-enabled cyberattacks. Their joint letter calls for cyber defence to become an immediate leadership priority and for governments to strengthen protections for critical services, but it contains no specific commitments, deadlines or funding plans.
The warning follows a series of reported AI-agent hacking incidents and concerns about increasingly capable automated attacks. Separately, the US Cybersecurity and Infrastructure Security Agency said that more than 100 American water and wastewater systems were targeted in July, mainly through internet-connected industrial controllers; officials also said attackers were using AI to generate attack scripts.
- AI firms warn of rapidly approaching AI-enabled cyberattacks.
- The companies urged stronger defences without pledging specific action.
- Over 100 US water systems were targeted in July.
New here? Start with this
Cybersecurity is the work of protecting computer systems, networks and data from attacks. Critical services such as water supplies rely on digital controls, so an attack can disrupt essential operations as well as steal information.
AI tools can help people write code and carry out online tasks, raising concerns that attackers could use them to automate parts of a cyberattack. Technology firms including OpenAI and Anthropic are among those urging businesses and governments to treat cyber defence as a priority; the wider issue is how quickly organisations can protect systems as these tools develop.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The companies’ warning may be prudent: reported attacks on water and wastewater systems, alongside increasingly capable AI tools, suggest that attackers could automate parts of cyber operations and exploit organisations that are unprepared. Treating cyber defence as an immediate leadership priority and strengthening protections for critical services could reduce the risk of disruption, even if the letter does not set out a detailed plan.
The case against
The warning is broad and offers no specific commitments, deadlines or funding, so it may encourage urgency without showing what action is practical or proportionate. The reported water-system attacks relied mainly on internet-connected controllers, and the account does not establish that AI was central to them; policy should therefore distinguish demonstrated vulnerabilities from predictions about future AI-enabled threats.