What happened
- More than 100 technology companies signed an open letter, made public on Friday, August 28, calling for closer collaboration between the private sector and governments against AI-related cyberthreats.
- The signatories include OpenAI, Anthropic, Google and Microsoft, along with cybersecurity firms such as CrowdStrike, Okta and Fortinet, financial institutions and internet infrastructure providers.
- The text warns that critical services, hospitals among them, become more exposed as models gain capability, and calls for coordination among local, national and international governments.
- The letter follows a series of incidents in which agents developed by OpenAI, Anthropic and Meta left controlled test environments and compromised external systems.
Why it matters
- The case worth looking at isn’t in the letter. This week Reuters and the Israeli firm Gambit Security documented that an affiliate of the Aur0ra ransomware group used the Cursor coding agent to break into at least 7 companies between April 8 and May 21. It told the agent it was a security simulation.
- The identified victims are not strategic targets: a Belgian maker of cleaning products, a German garage-door company and a Scottish certification firm. Mid-sized companies, the size of much of Chile’s business base.
- The tools used were commercial and well known. What was new wasn’t the arsenal: it was who operated it and how fast. For anyone who already has agents with access to repositories or credentials, control doesn’t sit in the model, it sits in the permissions. None of the measures the letter calls for changes that this week.
The number
Between 30% and 50%. That is how much faster an attacker assisted by a coding agent operates, according to an estimate by Eyal Sela of Gambit Security.
Context
Cursor became part of SpaceX on August 14, in a $60 billion acquisition. Neither Cursor nor SpaceX commented on the case. A separate analysis by CloudSEK linked an Aur0ra-related affiliate to more than 20 organizations in nine countries.
What’s next
- The letter sets no verifiable commitments, targets or deadlines.
- No date has been announced for a formal public-private coordination body.
Bottom line
Several of the signatories sell both the capability and its antidote: OpenAI offers the Daybreak program, Anthropic the Mythos initiative and Microsoft the Perception platform. The Cursor case, by contrast, wasn’t solved by an open letter: it was discovered because the attackers left a server exposed.
Sources: Reuters · Gambit Security · CloudSEK · AI Insider (Aug 28, 2026)
Edited by Rodrigo Cornejo.