The bad grammar was a budget

On August 27, more than a hundred companies signed an open letter about AI and cybersecurity. OpenAI organized it. Microsoft, Google, Anthropic, Amazon, Cisco, IBM, CrowdStrike and Cloudflare put their names on it, along with a pile of banks and insurers. Here's the blunt part:

"In the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated."

It's written for governments and infrastructure operators, and what it says is at risk is hospitals, water treatment plants, and "the infrastructure that powers the internet."

So, fair enough. Someone else's problem. You don't run a water plant.

Except the reasoning underneath isn't really about water plants. It's about cost, and on that front it applies to your inbox at least as much as the grid.

What actually changed

Attacks have always been expensive. Not in software. In hours.

The expensive part was never breaking in, it was the homework. Working out how one particular system was wired together. Picking up enough of an industry's vocabulary to sound like you belonged in it. Reading enough of a stranger's life to write them something they'd actually believe. That is slow work done by a person, and there are only so many hours in a week.

That's the ceiling coming down. AI hasn't invented a new attack here. It made the homework nearly free. What took a capable person a week now takes a model an afternoon, and it will do it again tomorrow, a thousand times over, and never get bored or ask for a cut.

The people who signed the letter are worried about what that does to a hospital. It's worth a minute on what it does to you.

Every tell you were taught was a price

Think about the advice everybody gets for spotting a scam.

Look for bad spelling. Look for "Dear Valued Customer" sitting where your name ought to be. Be suspicious of anything so generic it could have been written for anyone, because it probably was.

All of that was real advice, and it worked for years. But none of it was ever a security feature. It was a budget showing through.

Good writing costs money. Research costs more. An operation sending a million messages couldn't afford either at that volume, so the seams showed. Careful scams existed, but they had to be pointed at somebody worth a week of a con artist's time. If you weren't worth it, you got the cheap version, and the cheapness is what saved you.

We got near this back in June, writing about fakes with no typo and no broken logo to catch. At the time it looked like a story about better tools. It was really a story about cheaper ones.

The hospital part isn't a separate story

Here's how the infrastructure stuff comes back around to your phone.

Think about what's actually worth stealing from a hospital. Not money. Details. Your procedure and the date of it, your doctor's name, your insurer, the balance you still owe. That's the raw material for a phone call that opens with three true things about you before it asks you for anything.

None of which is new. The $913,000 the City of Pittsburg wired to a fake vendor worked because whoever sent that email knew things they had no business knowing. What changes now is the volume: more leaked details, cheaper personalization, both moving faster. The attack on a water utility and the call your mother gets on a Tuesday afternoon are the same story a few months apart.

The obvious objection

Better you hear this from us than work it out yourself. The companies ringing the alarm largely built the thing, and they would very much like to sell you the fix. The Register said exactly that a day after the letter went out, and it's a fair hit. There are no dollar amounts in the letter, no deadlines, and the recommended cure is mostly "more AI," conveniently available from the undersigned.

A warning can be self-interested and still be right. Take the analysis. Keep a hand on your wallet.

What still works when the writing gets good

The defenses that survive are the boring ones that never cared how good the con was.

• Check where a page lives, not how it reads. The domain is a fact you can look up. Everything else on that page is somebody's design choice, and AI is very good at design choices now.
• Call a number you already had. Not the one in the message. Hang up, find the number yourself, call back. No script survives you dialing somewhere else.
• Ask who started it. Nearly all of this begins with something arriving out of nowhere. Good writing doesn't change that shape.
• Slow down money that's in a hurry. Urgency is the one ingredient they still can't do without.

Where SAFE Portal fits

That's the case for putting the check in software instead of in your head. "Is this message real?" is a judgment call, and judgment calls get harder as the fakes get better. "Is this the domain I saved?" is a lookup. Lookups don't have off days.

What it won't do

SAFE Portal can't harden a hospital or patch a water utility, and it can't keep your records from leaking out of some system you never chose to hand them to. That's the real subject of the letter, and it needs the money and the deadlines the letter carefully doesn't mention.

What it can do is keep the fallout from landing on you as a question you have to answer correctly every single time. It's at SAFEPortal.to. Free to try, about two minutes to set up.