Over 400 Researchers Sign Open Letter Calling for Collaboration Between AI and Security Communities

As AI systems begin to permeate critical infrastructure, the siloed operation of the security community and AI researchers may become the greatest systemic risk.

An Open Letter, a Shared Anxiety Across Two Fields

Recently, more than 400 researchers jointly signed an open letter calling for closer collaboration between the AI community and the security community to jointly improve alignment and containment methods to protect critical infrastructure and digital systems.

The core demand of this letter is not a vague warning that "AI is dangerous," but rather points to a specific collaboration gap: AI researchers excel at building increasingly capable models, while the security community excels at discovering and defending against vulnerabilities—but the flow of knowledge and integration of methods between the two is far from adequate. The signatories clearly believe this gap is becoming a real threat.

Why Alignment and Containment Need the Security Community's Involvement

The traditional path of alignment research focuses on the model level—making AI goals consistent with human intent. But from a security perspective, alignment is only one link in the defense chain. If a well-aligned model is maliciously exploited, or if undiscovered security vulnerabilities exist in the deployment environment, alignment alone cannot prevent harm from occurring.

Containment intersects more directly with security engineering: how to limit the behavioral boundaries of AI systems, how to monitor anomalous outputs, how to quickly cut off a model when it is abused—these problems already have a wealth of mature practices in the security community, such as sandbox isolation, least privilege, and intrusion detection. Treating AI systems as objects that require continuous monitoring and constraint, rather than merely models that need to be "taught well," is the implicit shift in thinking behind this open letter.

Alignment in AI research refers to making a model's goals and behaviors consistent with human intent and values, with common techniques including reinforcement learning from human feedback (RLHF), constitutional AI, and interpretability probes. It focuses on whether the model "wants to do the right thing." Containment, on the other hand, originates from security engineering and AI control theory, referring to the ability to limit a model's behavioral boundaries through external mechanisms even when its goals deviate or it is maliciously exploited—such as sandbox isolation, capability threshold triggers, manual kill switches, and behavioral audit logs. It focuses on "even if it wants to do wrong, can it succeed?" The key difference between the two is that alignment is an internal property of the model, while containment is an external constraint on the system. Relying solely on alignment carries the risk of "alignment faking"—a model may appear compliant in its external behavior while actually retaining hidden goals; containment, by contrast, does not assume the model is trustworthy and reduces the probability of single-point failure through redundant defenses, which is why the security community views it as a more reliable last line of defense.

Why Critical Infrastructure Is the Focus

The open letter specifically calls out "critical infrastructure and digital systems," which is not a rhetorical choice. Power, water, transportation, and healthcare systems are rapidly incorporating AI capabilities, and their common characteristic is: once breached, the consequences far exceed data leaks and may directly threaten personal safety and social functioning.

The threat modeling, red teaming, and emergency response experience that the security community has long accumulated in these fields is precisely the resource that tends to be overlooked in AI safety discussions. Conversely, AI researchers' understanding of the predictability and unpredictability of model behavior can also help security teams more accurately assess new attack surfaces.

Critical Infrastructure generally refers to systems that play a decisive role in the basic functioning of society and public safety. Definitions vary slightly across countries, but they commonly cover energy, water, transportation, communications, healthcare, and finance. The common characteristics of such systems are: highly interconnected, long-cycle operation, nonlinearly amplified failure consequences, and often operated by mixed public-private entities. In recent years, AI capabilities are being introduced into areas such as power grid load forecasting, water anomaly detection, traffic scheduling, and medical diagnosis, improving efficiency while also introducing new attack surfaces—for example, data poisoning can corrupt scheduling models, and prompt injection can bypass the security policies of operations assistants. The traditional IT security triad of "confidentiality, integrity, and availability" shifts in weight in these scenarios, with availability and physical safety often placed first. This means AI safety assessments cannot simply copy the risk models of internet products.

Where the Collaboration Challenges Lie

Calling for collaboration is easy; implementation is difficult. The two communities have different discourse systems, release rhythms, and risk assessment frameworks. The AI field pursues the capability frontier, while the security field pursues defense in depth; AI papers emphasize benchmark scores, while security reports emphasize attack chain reproduction. This cultural difference can keep "come together" at the level of a slogan.

Another practical obstacle is the incentive structure. The disclosure process after security researchers discover vulnerabilities is relatively mature, but vulnerabilities in AI systems—such as prompt injection, jailbreaking, and data poisoning—lack unified classification standards and responsibility attribution mechanisms. The open letter can be seen as a collective response to this gap.

Prompt Injection refers to an attacker embedding malicious instructions in the input to induce a large model to deviate from its original task or leak sensitive information. It is divided into direct injection and indirect injection (such as being triggered through external content like web pages or documents). Jailbreak refers to bypassing a model's safety alignment through carefully crafted prompts, causing it to output content that should have been refused. Data Poisoning occurs during the training or fine-tuning stage, where an attacker mixes malicious samples into the dataset, causing the model to produce erroneous behavior under specific trigger conditions. These three types of vulnerabilities differ significantly from traditional software vulnerabilities (such as buffer overflows and SQL injection) in their causes and exploitability: they often lack stable patch boundaries, the same prompt performs differently across model versions, and they are difficult to fully describe using the traditional CVE numbering system. This is precisely the root of the gap in classification standards and responsibility attribution that the open letter points to.

What This Letter Means

The scale of more than 400 signatories shows that this is no longer the concern of a few security paranoids. As AI capabilities continue to embed themselves in the foundational layers of social operation, pure technological optimism or pure security defense thinking alone is insufficient to address compound risks. The value of the open letter lies in redefining "AI safety" from a question of model properties to a question of cross-system engineering collaboration.

As for whether it can drive actual joint research, shared standards, and policy recommendations, that depends on whether the two communities are willing to truly step out of their respective comfort zones.

Systemic Risk in this context does not refer to the harm of a single model or a single attack, but rather the possibility of overall failure arising from coupling, cascading effects, and shared dependencies after AI capabilities are embedded in multiple critical systems. For example, if multiple infrastructure systems simultaneously adopt the same foundation model, once that model has an undiscovered bias or is exploited by the same attack method, the risk will rapidly propagate along the supply chain. To address such risks, alignment at the model level or single-point security hardening alone is insufficient. It requires introducing a macroprudential perspective similar to that in financial regulation: establishing cross-domain threat intelligence sharing, model supply chain auditing, failure drills, and joint response mechanisms. The open letter redefines "AI safety" as a cross-system engineering problem, which is precisely an echo of this perspective.

One-line Summary

Over 400 researchers sign an open letter calling for collaboration between the AI and security communities to jointly improve alignment and containment to protect critical infrastructure.

Paragraph Summary

More than 400 researchers jointly signed an open letter calling for stronger collaboration between the AI community and the security community to jointly improve alignment and containment methods to protect critical infrastructure and digital systems. The letter points out that AI researchers excel at building increasingly capable models, while the security community excels at discovering and defending against vulnerabilities, but the flow of knowledge and integration of methods between the two fields is far from adequate, and this gap is becoming a real threat. Alignment is only one link in the defense chain, while containment relies more on security engineering practices such as sandbox isolation, least privilege, and intrusion detection. Critical infrastructure has become the focus due to the severity of consequences, and the threat modeling, red teaming, and emergency response experience long accumulated by the security community can precisely fill the shortcomings of AI safety. Implementation of collaboration still faces obstacles such as cultural differences, incentive structures, and the lack of vulnerability classification standards.