--- title: Why OpenAI is calling for a ‘cyber defense surge.’ Plus:... description: A cybersecurity podcast panel discusses OpenAI's open letter (signed by 100+ organizations including IBM) calling for a global 'cyber defense surge' against... canonical: https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Why OpenAI is calling for a ‘cyber defense surge.’ Plus: Find Evil! winners and TeamPCP losers | daily.dev og:description: A cybersecurity podcast panel discusses OpenAI's open letter (signed by 100+ organizations including IBM) calling for a global 'cyber defense surge' against... og:url: https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu og:image: https://api.daily.dev/og/posts/wU0iPkOnU.png og:image:alt: Why OpenAI is calling for a ‘cyber defense surge.’ Plus: Find Evil! winners and TeamPCP losers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Why OpenAI is calling for a ‘cyber defense surge.’ Plus: Find Evil! winners and TeamPCP losers **[IBM Technology](https://daily.dev/sources/ibmtechnology)** · 29 min read · 0 upvotes · 0 comments ## Summary A cybersecurity podcast panel discusses OpenAI's open letter (signed by 100+ organizations including IBM) calling for a global 'cyber defense surge' against AI-enabled attacks, urging sharing of remediation strategies and empowering defenders with AI. Panelists debate whether the letter is genuine or a publicity stunt tied to the Hugging Face hack, and discuss risks of AI restrictions hobbling defenders while attackers strip guardrails. The episode also covers SANS Institute's 'Find Evil' hackathon winners, all open-source AI agent harnesses for incident investigation notable for self-questioning behavior, with panelists stressing that autonomous agents should investigate but not take unsupervised response actions. Finally, they discuss Flare's unmasking of alleged Team PCP hacking gang leaders (arrested in Australia), who were caught due to reused usernames and passwords across a gaming account and hacking infrastructure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What did OpenAI's open letter on cyber defense actually call for? OpenAI's open letter, signed by over 100 organizations including IBM, urges a global surge in cyber defense to counter increasingly sophisticated AI-enabled attacks. It calls on public and private organizations to treat cyber defense as an immediate priority second only to critical business operations, and outlines three principles: going beyond status-quo security, empowering defenders with cyber-capable AI, and mobilizing a collective response, including sharing threat intelligence and remediation strategies. _Security teams weighing how seriously to treat AI-driven attack trends can follow this debate as it develops on daily.dev._ ### How were the alleged leaders of the Team PCP hacking gang identified and arrested? Researchers at Flare identified alleged Team PCP leaders by tracing a reused username, dead cat X3, across multiple platforms including a Steam gaming account, then finding reused passwords tied to that identity. This poor credential hygiene linked their hacking activity to real identities, leading to arrests in Australia. Team PCP was previously tied to a breach involving a stolen service account token for the security scanner Trivy and a malicious release of LiteLLM. _Anyone tracking credential hygiene and threat actor takedown stories can follow similar security research on daily.dev._ ### Should autonomous AI agents be allowed to take direct incident response actions like shutting down servers or revoking identities? No, human oversight should remain in the loop for high-consequence response actions such as shutting down servers, revoking identities, changing firewall policies, or terminating processes, even though autonomous agents have proven credible at investigation tasks like correlating evidence and reconstructing timelines. The distinction is that finding evil and acting on evil are fundamentally different activities requiring different levels of trust in AI autonomy. _Teams deciding how far to trust AI agents in security workflows can track this ongoing debate on daily.dev._ --- Tags: [#cyber](https://daily.dev/tags/cyber), [#open-source](https://daily.dev/tags/open-source), [#ai-security](https://daily.dev/tags/ai-security) [View this post on daily.dev](https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Why OpenAI is calling for a ‘cyber defense surge.’ Plus: Find Evil! winners and TeamPCP losers","url":"https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu"},"datePublished":"2026-09-02T10:23:37.395Z","dateModified":"2026-09-02T10:25:05.021Z","description":"A cybersecurity podcast panel discusses OpenAI's open letter (signed by 100+ organizations including IBM) calling for a global 'cyber defense surge' against...","image":"https://i.ytimg.com/vi/-0p68wKEitE/sddefault.jpg","thumbnailUrl":"https://i.ytimg.com/vi/-0p68wKEitE/sddefault.jpg","isAccessibleForFree":true,"articleSection":"IBM Technology","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IBM Technology","logo":"https://media.daily.dev/image/upload/s--OXHaOiWX--/f_auto/v1715498011/logos/ibmtechnology","url":"https://daily.dev/sources/ibmtechnology"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"cyber,open-source,ai-security","timeRequired":"PT29M","video":{"@type":"VideoObject","name":"Why OpenAI is calling for a ‘cyber defense surge.’ Plus: Find Evil! winners and TeamPCP losers","description":"A cybersecurity podcast panel discusses OpenAI's open letter (signed by 100+ organizations including IBM) calling for a global 'cyber defense surge' against...","thumbnailUrl":"https://i.ytimg.com/vi/-0p68wKEitE/sddefault.jpg","uploadDate":"2026-09-02T10:23:37.395Z","duration":"PT29M","url":"https://api.daily.dev/r/wU0iPkOnU","embedUrl":"https://www.youtube.com/embed/-0p68wKEitE"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IBM Technology","item":"https://daily.dev/sources/ibmtechnology"},{"@type":"ListItem","position":3,"name":"Why OpenAI is calling for a ‘cyber defense surge.’ Plus: Find Evil! winners and TeamPCP losers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/why-openai-is-calling-for-a-cyber-defense-surge-plus-find-evil-winners-and-teampcp-losers-wu0ipkonu#faq","mainEntity":[{"@type":"Question","name":"What did OpenAI's open letter on cyber defense actually call for?","acceptedAnswer":{"@type":"Answer","text":"OpenAI's open letter, signed by over 100 organizations including IBM, urges a global surge in cyber defense to counter increasingly sophisticated AI-enabled attacks. It calls on public and private organizations to treat cyber defense as an immediate priority second only to critical business operations, and outlines three principles: going beyond status-quo security, empowering defenders with cyber-capable AI, and mobilizing a collective response, including sharing threat intelligence and remediation strategies. Security teams weighing how seriously to treat AI-driven attack trends can follow this debate as it develops on daily.dev."}},{"@type":"Question","name":"How were the alleged leaders of the Team PCP hacking gang identified and arrested?","acceptedAnswer":{"@type":"Answer","text":"Researchers at Flare identified alleged Team PCP leaders by tracing a reused username, dead cat X3, across multiple platforms including a Steam gaming account, then finding reused passwords tied to that identity. This poor credential hygiene linked their hacking activity to real identities, leading to arrests in Australia. Team PCP was previously tied to a breach involving a stolen service account token for the security scanner Trivy and a malicious release of LiteLLM. Anyone tracking credential hygiene and threat actor takedown stories can follow similar security research on daily.dev."}},{"@type":"Question","name":"Should autonomous AI agents be allowed to take direct incident response actions like shutting down servers or revoking identities?","acceptedAnswer":{"@type":"Answer","text":"No, human oversight should remain in the loop for high-consequence response actions such as shutting down servers, revoking identities, changing firewall policies, or terminating processes, even though autonomous agents have proven credible at investigation tasks like correlating evidence and reconstructing timelines. The distinction is that finding evil and acting on evil are fundamentally different activities requiring different levels of trust in AI autonomy. Teams deciding how far to trust AI agents in security workflows can track this ongoing debate on daily.dev."}}]} ```