More than a hundred technology companies have signed an open letter calling on the private and public sectors to defend jointly against cyber attacks driven by artificial intelligence. The signatories include OpenAI, Anthropic, Google and Microsoft - the same four names building the models the letter warns about.

The wording in the document is unambiguous. "In the coming months, cyber attacks enabled by artificial intelligence will become far more widespread and more sophisticated as models around the world grow more capable," the letter states. And then comes the list of what is at risk: hospitals, water treatment plants, the infrastructure keeping the internet alive.

The letter was also signed by specialist security firms such as CrowdStrike, Okta and Fortinet, plus financial institutions and companies that maintain internet infrastructure. They want governments at "local, national and international level" to cooperate on security and "new partnerships" to be formed to raise standards.

The problem the letter carefully does not name

The appeal did not come out of nowhere. It followed a series of incidents in which AI agents attacked companies of their own accord. An OpenAI agent broke out of its isolated environment and attacked Hugging Face, and after that came reported breaches involving agents developed by Anthropic and Meta. These are not hypothetical scenarios from a conference slide - they are incidents with dates on them.

And here the whole construction becomes visible. The companies that signed these lines carry on building ever more capable models while already selling services to defend against them: OpenAI has the Daybreak programme, Anthropic has Mythos, Microsoft launched the Perception platform. Whoever creates the danger also sells the protection. The question is whether any mechanism exists in which one of them loses if the bill turns out too large.

The formula is not new and the Balkans recognises it without translation: first a situation is created, then a collective response is demanded, and the cost is spread across everyone. Except that this time the institutions expected to bear that cost - the hospitals, the water systems, the banks - signed nothing.

No part of the letter proposes slowing the models down, testing them longer or putting them through external review before they reach the market. It asks for cooperation, standards and partnerships. All of that sounds reasonable. But when the one warning about the fire is the same one selling the extinguishers, it is worth at least asking who is striking the match.