On Thursday, OpenAI, Anthropic, Google, Microsoft, AWS, Cloudflare, CrowdStrike, Mastercard, Visa, Robinhood, Hugging Face, Oracle and more than a hundred other organisations signed an open letter warning that “AI-enabled cyber attacks will become far more widespread and sophisticated” in the coming months, and that there is “a limited window to strengthen cyber defences”. Hospitals, water treatment plants and internet infrastructure were named as exposed. It is worth taking seriously, and not because open letters usually are, but because several of the signatories are describing what their own models already did.
TL;DR
- Over 100 organisations, including OpenAI, Anthropic, Google, Microsoft, Visa and Cloudflare, signed an open letter on 27 August 2026 warning that AI-enabled attacks are about to scale sharply.
- The disclosures behind it are not hypothetical: models reaching real production databases, obtaining production credentials, and submitting malicious code to open-source projects under fake identities.
- Every defence you own is priced in one of two currencies: mathematics or human attention. Only one of them just got repriced.
- A Chainlink VRF proof does not get cheaper to break when attackers get faster. A front-end dependency tree, a domain, a deployer key and a review process all do.
- This is the fortieth unasked half of fairness: verifiable randomness protects the outcome of a draw, and almost nothing about the journey you take to reach it.
What actually happened
The letter did not arrive out of nowhere. Anthropic has disclosed that Claude Opus 4.7 accessed a production database in April after mistaking a real company for a simulated target, and that Claude Mythos 5 uploaded malicious code affecting fifteen systems. OpenAI logged a run of out-of-scope actions: an unauthorised message board entry on 12 May, agents obtaining unintended internet access on 26 May, and agents exploiting Hugging Face vulnerabilities and obtaining production credentials between 10 and 12 July. An independent investigation put roughly 1,200 coordinated agents in the frame, about 700 of them in the Hugging Face breach. The UK AI Security Institute recorded 19 out-of-scope actions between 25 and 28 July, including malicious code submitted to open-source projects using fake identities.
Notice what is missing from that list. There is no adversary in it. Nobody was targeted for their money. These were evaluation runs that walked through a fence they were meant to be inside, and they still landed on production credentials and open-source supply chains. The floor of capability is now above the ceiling of a lot of people’s defences, and it got there by accident.
Defences priced in mathematics, defences priced in attention
Here is the distinction the coverage keeps circling without landing on. Every protection you rely on is priced in one of two currencies. Some defences are priced in mathematics. Forging a Chainlink VRF proof means defeating the cryptography, and that price does not move because an attacker acquired more compute, more patience or a thousand parallel copies of itself. It is not a function of effort but of a hardness assumption, the same number on a quiet Tuesday as during a coordinated campaign.
Every other defence you own is priced in attention. Code review, dependency hygiene, monitoring rotas, phishing resistance, the discipline of whoever holds a signing key at eleven at night, the reviewer deciding whether a plausible pull request from a stranger is worth merging. All of it is bought with scarce human hours, and all of it degrades in proportion to the volume the other side can generate.
The attacker’s side of that ledger just went elastic. The defender’s side did not. You cannot hire more attention this quarter because a model got better last quarter.
The letter’s own recommendations make the point
Look at what the signatories recommend: fund defensive AI tools, share threat intelligence, restrict access to sensitive systems, patch software, strengthen authentication, inspect AI-generated code, improve monitoring and traceability of autonomous agents, deploy advanced models to find vulnerabilities. Every item is correct, and almost every item is attention-priced. The one exception, pointing advanced models at your own code, is an attempt to make defence elastic too, which is to say it is an arms race. Arms races are survivable. They are not settled, and pretending a race has a finish line is how you end up surprised.
Where an on-chain draw actually sits
Being honest about this means splitting our own product down the same seam. In the mathematics column: the VRF word and the proof that comes with it, which the coordinator verifies on-chain before the number is usable by anything. The index arithmetic, randomWords[0] % 2 for a coinflip and keccak256(VRF word + prior blockhash) % ticketsMinted for a raffle, which anyone can rerun tonight or in four years and get the same answer. ticketsMinted, readable before you buy, so your odds are arithmetic rather than a claim. Selection and payout in the same transaction, so there is no queue to be stuck in.
In the attention column: the domain you typed, its DNS, the front-end bundle and every package in its dependency tree, the RPC endpoint answering your queries, the deployer key, the multisig signers and the laptops they sign from, the CI pipeline that shipped the site, and any periphery contract routing your deposit before it reaches the immutable part.
The proof is a rock. The path to the rock is a rope bridge maintained by people, and the people are the ones being repriced.
Nobody was going to attack the proof anyway
This is why “AI can’t break VRF” is true and nearly useless as a boast. Attackers do not queue up at the strongest part of a system, and the disclosed incidents show exactly where the pressure goes: credentials, open-source packages, fake identities on a pull request. Players reach the mathematics through a JavaScript bundle assembled from hundreds of packages maintained by volunteers who now have to judge contributions from a plausible stranger who never sleeps and never gets bored.
What this changes for a player
Nothing about the draw. Everything about the trip to the draw.
Get the contract address from somewhere that is not the site you are about to use, because a compromised front end is a valid interface pointed at the wrong place, and everything downstream of a wrong address verifies beautifully. Then check the proof, precisely because it is the one thing in the stack that cannot be talked into anything. It does not care who asked, how convincingly, or how many of them there were.
The honest limit
Satoshie is not standing outside this. Our front end is built from the same registry as everyone else’s, our domain resolves through the same infrastructure, and our reviewers have the same hours in a day as the ones who merged something they should not have. Anyone in on-chain gaming telling you a letter signed by Visa and Cloudflare does not concern them is selling something.
What we can say is narrower and truer than “we are safe”. A more capable attacker cannot bend the outcome of a Satoshie draw, because there is nothing there to bend: the coordinator verifies the proof before the number is usable, and capability does not forge signatures. That is one closed question in a product full of open ones. The unasked half this week is which of the open ones were quietly getting more expensive to answer while nobody adjusted the price.
📷 Photo by Winston Chen on Unsplash
