Opinion | America Needs a 911 Line for Cybersecurity

Hackers are about to have a field day. OpenAI announced last week that its artificial-intelligence model discovered two bugs in PHP, a computer language behind 70% of websites on the internet. The bugs let a stranger take over any website. The National Security Agency issued an emergency alert urging businesses to fix these vulnerabilities immediately—or take their sites offline. Canada, the U.K. and at least seven other countries took down government websites as a precaution.

Several other systemic bugs have been discovered. September saw more vulnerabilities than any month on record, and experts are calling this month “Black October.”

Hackers have been on the move. Microsoft announced last week that a Chinese state-linked group used AI to attack hundreds of organizations, attempting to breach more than 2,250 Microsoft systems. A day earlier, the FBI announced that a single hacking gang, SafePay, had broken into and locked up the systems of at least 600 businesses and critical-infrastructure operators.

So who should victims call? Right now, there’s no good answer. Washington should give them one: a 911 for AI cyberdefense, where American individuals and organizations under attack can get emergency access to top AI models to defend themselves.

Normally, models like ChatGPT and Claude come with built-in filters that block users from hacking. The problem is that these same filters can block those defending against cyberattacks. Attackers avoid these filters by using open-source models, which anyone can download and strip of safeguards. Americans attempting to use superior closed-source models to defend themselves from attacks often find their efforts stymied by the filters.

OpenCode, a company that makes a popular coding tool, announced in mid-October that it was under nonstop attack for 48 hours. The company tried to use frontier models to defend itself, and initially that worked. But then the models’ safety filters went on, and the models refused to help any further.

Fortunately, OpenCode wasn’t defenseless for long. U.S. AI companies like OpenAI and Anthropic have built programs to help those under attack by giving them access to their models with fewer safeguards. OpenCode had applied (before the cyberattack began) for OpenAI’s program, and by pure coincidence it was accepted in the midst of the cyberattack.

But these programs can’t come to the rescue wherever and whenever hackers attack. That’s why there needs to be a 911 for AI cyberdefense. Someone under attack should be able to call and get monitored access to AI models without guardrails for a limited time—say, 72 hours.

The government is well-positioned to help build this. It often knows about an attack even before the victim does. Since late 2022, the Cybersecurity and Infrastructure Security Agency has warned organizations more than 4,300 times that they were getting hacked. The government can also help with verification: For many potential victims, CISA already knows who they are, since nearly 7,800 critical-infrastructure organizations have enrolled in its free vulnerability-scanning service.

The government has built emergency lanes like this before, like the Telecommunications Service Priority program. Further, lying to a government agency is a federal crime, which should deter imposters.

During the attack on OpenCode, its co-founder wrote that his team needed AI agents running around the clock “because that’s what [the attackers] have.” With a hacking avalanche under way, vulnerable Americans need a way to call agents of their own.

Messrs. Dagher and Xiao are students at Yale Law School. Tal Feldman contributed to this article.