The window is closing: OpenAI, Google and Anthropic signed the same letter on the same day

On August 27, something happened that almost never happens. OpenAI, Google, Anthropic and Microsoft signed the same document on the same day.

These four companies, which fight and compete over everything (customers, engineers, chips), signed a joint open letter, with more than a hundred other organizations behind it: Amazon, Cloudflare, IBM, Oracle, CrowdStrike, and banks like BBVA and Citi. The list keeps growing, because the document is still open for new signatures.

When people who compete like that agree on something, it's usually because there's a fire.

Who isn't there yet is also striking. Meta, Nvidia and Apple, to name the biggest ones that didn't sign.

What exactly happened?

The letter is titled A call for collective action on cyber defense, and it says three things:

1. That security the way we do it on the internet today won't be enough.
2. That AI tools need to be put in the hands of the people defending others.
3. And that this has to happen collectively, the sooner the better.

The sentence that sums it all up:

"In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable."

Without the jargon: until today, getting into a company's systems took a person with time, knowledge and patience, trying door after door to see which one gives. AI turns that into something you can do on thousands of doors at once, much faster and practically without stopping.

The other half of the news is the good half. That exact same tool lets you check your own doors before somebody else tries them.

Why announce it now?

Because three weeks ago, on August 10, OpenAI released a model specialized in cybersecurity. The difference from normal models is easy to see: when you ask a regular ChatGPT to help you look for security flaws, you generally get a message along the lines of "this request doesn't comply with our usage policies".

That happened because the AI has no way of knowing whether you're the one protecting the system or the one trying to break it. In OpenAI's internal testing, the general model accepted 1.5% of those requests. The new one accepts 95% of requests like that. Access is limited to vetted organizations.

It's the same capability as always, with the brake released for whoever is authorized.

And it didn't stay theoretical. They pointed it at Chrome, the browser used by close to 70% of everyone online, and it found two flaws nobody knew about which, chained together, let you get past the protections in place. Google has already fixed them. For anyone who wants to check, the public record is CVE-2026-15903.

This had already happened with Claude. In April of this year Mozilla gave it early access to Mythos, and the model found 271 flaws in Firefox, 180 of them high severity. That month Mozilla ended up patching 423 vulnerabilities, roughly twenty times its monthly average from the year before, which sat at 21. So OpenAI took its time, but it caught up to where Anthropic already was in April. Have we reached the point where the models can't get much better? Or maybe the improvement has to go in a different direction, prioritizing safety and alignment over productivity.

The defender's window

The defender's window, which is what OpenAI calls it in the letter, is the period in which artificial intelligence gives more of an advantage to whoever defends a system than to whoever attacks it.

Why does it favour the defender? Because they already know where their systems are, they have the code, they have the access and they can review all of it from the inside. The attacker has to find it first. That's an advantage, though it seems it isn't enough.

That advantage has an expiry date, even if nobody knows what it is, because these capabilities get cheaper and spread very fast. Hence the name: there's a window open to fix what's broken, and it closes the moment fixing it stops being an advantage. Months or a couple of years, says the letter. There doesn't seem to be a consensus.

Would this affect my company?

Yes, and probably less because of AI than you'd think.

Andy and I have talked about this several times on Stalmanía: AI amplifies what you already do, for better and for worse. If you have order, clear processes and a sensible sense of what information is delicate, AI multiplies that.

If you pass passwords around on WhatsApp like it's harmless, if nobody remembered to revoke access for the person who left six months ago, if everyone stores things their own way, AI multiplies that too.

The clearest example is recent, it happened in Spain, and it has nothing to do with artificial intelligence. In April 2026, Basic-Fit disclosed that someone had gotten into its member database. Close to a million people affected across six countries, Spain among them. Names, addresses, emails, phone numbers, dates of birth and, in some cases, bank account numbers were exposed.

Passwords and ID numbers were not exposed, and the company says it detected and cut off the access within minutes. Even so, Spain's consumer organization had to warn members that they'd be getting calls and messages impersonating the gym or their bank.

That attack didn't need AI. And that's the point: if this already happens without AI, what the letter is saying is that from now on it will happen more often and faster.

And there's a very common confusion worth clearing up here, because the line isn't where almost everyone thinks it is. It isn't between a free plan and a paid one. It's between a personal account and a company account.

A paid personal plan, the twenty-euros-a-month kind, is still a personal account. By default, what you type there can be used to train the model, and to prevent that you have to go into settings and switch it off yourself. Company accounts come the other way around out of the box. Team plans, enterprise plans and API access don't train on your data unless somebody deliberately turns it on.

How long what you type into your chats is kept changes too. On a personal account with that option on, a conversation can stick around for years; over the API it's a matter of days, and in the bigger contracts you can ask for nothing to be kept at all.

I bring it up because the scenario I run into most is exactly the worst one. A whole team using AI every day on paid personal accounts, convinced that paying covers them. They have the switch on where it doesn't suit them, and moving it takes two minutes. I left the exact route for all three tools here: how to stop AI from using your information. Watch out for Gemini, which works differently from the other two.

Even so, that doesn't excuse you from thinking. Does it mean you can't give it a client's name or a project's details? No. It means the genuinely confidential stuff, the kind you wouldn't want to see in an email forwarded by mistake, is probably better handled by a person rather than an outside service. Common sense, which is exactly the part everyone skips.

What if what I'm building with AI isn't secure?

Here I have to get personal.

On one of my projects, built largely with AI's help, I password-protected a private area of the system. I checked the password, it worked, and I stopped worrying about it. A few weeks ago I sat down to review it properly, because there's nothing better than a review every once in a while, also with AI's help, and I found two things.

1. The check was written in such a way that if the password ever stopped being configured on the server, the system blocked nobody. It let everyone through. A lock that opens by itself if you take the key away.

2. This one was even worse. There was a part of the system that called an AI model and had been left with no access check at all. Anyone who knew the address could have used it from their own computer and burned through my AI account at my expense, with no limit, and I wouldn't have found out until the bill arrived.

About the first one, which is what surprised me most: the password doesn't live in the code, it lives in a server setting. The code compared what the visitor sent against that setting, and if the setting wasn't there, the comparison was between two empty things. Empty against empty means "they match", so the door opened on its own. It doesn't take an attack for that to happen, just an oversight: you deploy the project to a new environment and didn't copy the settings over, somebody deletes it from the panel while tidying up, or you change the password and the deploy lands right in the middle. The fix was to make the check fail closed, meaning that if the value is missing it denies instead of letting you through.

Neither one caused any consequences and both are fixed. But the detail that matters is different: they'd been sitting there for months, this is what I do for a living, and I didn't see them. They turned up when I explicitly asked an AI to go find what was wrong.

That's the letter's thesis in miniature. Building has become a piece of cake, which is why far more people are building. Reviewing what you built has become just as easy, but only if you remember to do it. And almost nobody remembers, because when a thing works there doesn't seem to be anything to look at or touch.

The uncomfortable part needs saying too

The same company warning about the fire has spent three weeks selling extinguishers. The cybersecurity model came out on August 10, its access program is already available through Amazon, and the letter is from the 27th. Engadget was blunt and called it an alarmist ad dressed up as public service.

I don't go that far, but I don't swallow it whole either. If this were only OpenAI marketing, neither Anthropic nor Google would sign it, because they're precisely the ones who lose if OpenAI owns the narrative. That they compete the way they do and still signed the same thing on the same day is, to me, the part worth looking at. The messenger may have interests, but that doesn't make the message false.

What to take away

That security on the internet stopped being an IT department matter and became a strategic decision that involves the whole company. The excuse of "I don't have budget for this" just ran out of road, because the review that used to require an expensive consultant is something you can start yourself in an afternoon. It won't be as effective, but it's already progress.

This is less about technology than it looks, and more about order. About knowing what you have, who gets in, what information is delicate and what stays out of the machine. AI doesn't fix disorder, it accelerates it. It's the same thing I was saying a few days ago about learning by doing: the tool amplifies whoever uses it, in the direction they were already heading.

It's a conversation I'm having a lot lately with leadership teams, and one I keep ending up taking on stage, because this isn't a topic for IT people.

The window is open. Nobody knows for how long.

Do you think cybersecurity should have its own department, given the way things are going?

Thanks for reading. Un abrazo.