Every Major AI Company Agrees: We're Not Ready for What's Coming

Welcome Back to The AI Trust Letter

Once a week, we distill the most critical AI & cybersecurity stories for builders, strategists, and researchers. Let’s dive in!

🌐 OpenAI and 130+ Companies Call for a Coordinated Cyber Defense Effort

The Story:

On August 27, OpenAI published an open letter, joined by Anthropic, Google, Microsoft, Amazon, Cisco, CrowdStrike, IBM, Oracle and more than 130 other companies, warning that AI-enabled cyberattacks will get more widespread and more sophisticated in the coming months and calling for a coordinated global effort on cyber defense.

The details:

• The letter argues that attacks which used to require a skilled human operator can now be automated end to end, putting hospitals, water treatment plants and core internet infrastructure at greater risk

• Signatories are asking governments to fund and coordinate defense for under-resourced critical infrastructure, and asking frontier labs to give defenders early access to their most capable models during major incidents

• The letter frames this as a limited window: AI is currently improving defensive work (patching, detection, threat intel sharing) faster than it's improving attacker capability, but that gap is expected to close

• It landed one day after OpenAI and independent investigators published their full technical report on the Hugging Face breach, and reads in part as an industry response to that incident

Why it matters:

A pledge signed by the same labs racing to ship more capable models is a signal about their own threat assessment, not just a coordination gesture. The specific asks, faster access to frontier models during incidents and dedicated funding for under-resourced infrastructure, also point to where the industry believes the actual gap sits right now.

Read full article

🧬 Cisco Research: Country-of-Origin Labels Don't Show What's Actually in a Model

The story:

Cisco and VAIL published research showing that a model's publisher name and country label say little about its real technical lineage. Using two separate fingerprinting methods, one on model weights and one on behavioral patterns, they found models routinely carry traits inherited from earlier models built in a different country than the one on the final label.

The details:

• The researchers call this "provenance entanglement": most models today are fine-tuned from existing checkpoints rather than trained from scratch, so a US-labeled model can carry behavior inherited from a Chinese base model, and the reverse

• As a test case, the team compared Nvidia's Nemotron family to Alibaba's Qwen. Some Nemotron variants are documented as fine-tuned on Qwen base weights, others on Nvidia or Meta Llama weights, and the two are indistinguishable from the published label alone

• Both fingerprinting methods detected the inherited lineage even after a model had been post-trained and re-released under a different publisher's name

• Cisco argues models need their own equivalent of a software bill of materials, but notes the dependencies aren't listed in a manifest file, they're encoded directly in the weights, which makes this harder to automate than tracking a code dependency tree

Why it matters:

Policy and procurement decisions increasingly treat national origin as a proxy for risk. This research shows that proxy breaks down at the technical level. A label tells you who shipped the final model, not what it inherited underneath. For AI vendor due diligence, "which base weights" is a much stronger question than "which country."

Read full article

🧾 Linux Foundation Takes Over TRACE, a Hardware-Backed Record of What AI Agents Do

The story:

The Linux Foundation announced it will govern TRACE (Trust, Runtime Attestation and Compliance Evidence), an open specification built by OPAQUE with AMD, Intel, Microsoft and the UAE's Technology Innovation Institute that produces a verifiable record of what an AI agent actually did at runtime.

The details:

• TRACE ties the runtime environment, the software executed, the policies applied, data classifications, and which tools an agent invoked into a single cryptographically signed record, anchored in hardware attestation (AMD SEV, Intel TDX) instead of relying on the agent's own logs

• It builds on existing standards rather than inventing a new stack: RATS for the attester and verifier roles, EAT for the claim format, and SCITT for anchoring records to a transparency ledger

• The resulting record, called a Trust Record, is designed to be portable across clouds and confidential computing environments, so the same evidence travels with the workload wherever it runs

• The reference implementation had already logged close to 135,000 PyPI downloads in the ten weeks since its first preview in June, ahead of this week's formal handover to the Linux Foundation for vendor-neutral governance

Why it matters:

Most agent governance today relies on the agent's own logs, a self-reported account from the same system being audited. TRACE moves that evidence to the hardware layer, so an incident investigation or a compliance audit no longer depends on trusting the agent's account of its own actions.

Read full article

⚡ Trump Declares National Emergency Over Foreign Equipment in the US Power Grid

The story:

President Trump signed Executive Order 14420 on August 26, declaring a national emergency over security risks in foreign-supplied bulk-power system equipment and giving the Department of Energy new authority to restrict or unwind that equipment when it poses a sabotage or backdoor risk.

The details:

• The order blocks the purchase, import or installation of foreign-made power equipment, software, firmware and remote-access tools when the Department of Energy determines they pose an unacceptable security risk, and it also covers equipment already installed, not just future purchases

• The Department of Energy has 120 days to inspect existing equipment, build a list of approved vendors, and identify high-risk suppliers, working with the Departments of Defense and Commerce on the detailed rules

• The order names the growth of data centers, AI and advanced manufacturing as reasons the country's dependence on grid reliability has increased, since a disruption now reaches far beyond the energy sector

• Its structure closely mirrors a 2020 order that led to restrictions on Chinese-made grid equipment, though this order does not name a specific country

Why it matters:

AI's power demands are cited by name in a national emergency declaration. As data center and inference capacity keeps concentrating demand on the grid, expect more of AI's supporting infrastructure, power, cooling, networking, to get pulled into national security and supply chain policy the same way chips already have.

Read full article

🛡️ How an AI Gateway Stops Prompt Injection and Excessive Agent Permissions

The story:

This week we published a deeper look at what an AI gateway needs to do at the security layer specifically, not just routing and observability, but the controls that stop prompt injection, data leakage and excessive agent permissions before they turn into an incident.

The details:

• Traditional WAFs and API gateways inspect syntax, headers, payload size, known signatures, which is exactly what prompt injection doesn't trip, since a malicious instruction is just well-formed natural language sitting inside a normal request

• We map the OWASP Top 10 for LLM Applications directly to gateway controls: prompt injection (LLM01) to real-time inspection, sensitive data disclosure (LLM02) to PII redaction, excessive agency (LLM06) to token- and tool-level access controls, and unbounded consumption (LLM10) to rate limiting

• IBM's 2025 Cost of a Data Breach Report found that 97% of organizations that suffered an AI-related breach had no AI access controls in place, and that heavy use of AI and automation in security operations cut breach costs by an average of $1.9 million

• The EU AI Act's Articles 12, 19 and 26 require automatic event logging and record retention for high-risk systems, requirements a gateway satisfies by default instead of every application needing to build its own logging

Why it matters: 

Most AI security incidents don't come from a novel exploit. They come from production traffic moving through no inspection point at all, no check on what a prompt contains, no limit on what a tool call can reach, no record of what happened after the fact. A gateway is where that gap gets closed, without rebuilding the same checks inside every application and agent that talks to a model.

Read full article

What´s next?

Thanks for reading! If this brought you value, share it with a colleague or post it to your feed. For more curated insight into the world of AI and security, stay connected.