A warning that cuts across the industry

OpenAI, Anthropic, Google, Microsoft, and more than 100 other companies and organizations have issued a stark joint warning: AI-powered cyberattacks could become dramatically more widespread and sophisticated within months. The statement isn’t just another tech industry press release. It’s a coordinated alarm from the very companies building AI and the ones defending against its misuse.

The group is calling for a global push on cyber defense as more capable AI models make attacks easier to automate and harder to contain. Hospitals, water treatment plants, and internet infrastructure are among the systems it says could face greater risk if defenses don’t improve quickly enough.

This AI cyberattacks warning carries extra weight because it isn’t coming from one corner of the tech industry. AI developers, cybersecurity firms, and infrastructure companies are all backing the same basic message: defenders need to move now.

Why this warning is unusually broad

The companies involved sit on different sides of the cybersecurity problem. Some are building increasingly powerful AI systems, while others spend their time defending networks against attacks. That makes the warning harder to dismiss as one company pushing its preferred policy.

The coalition brings together organizations with very different commercial interests, yet they agree that existing defenses need to improve before AI gives attackers another advantage. Its recommendations include stronger baseline security standards and wider access to defensive AI, especially for organizations without large cybersecurity budgets.

Critical infrastructure gets particular attention. Failures there can quickly spill beyond a single organization, affecting entire communities or even national economies.

What defenders are being asked to do

The coalition wants governments and organizations to expand access to AI tools that can find vulnerabilities and speed up patching. Smaller institutions are a major concern because they may lack the staff or money to react quickly as attacks become more automated.

Software development is another weak point. The coalition is calling for tougher security standards around AI-generated code, since AI makes it easier for attackers to probe systems for weaknesses. The basic strategy is to give defenders stronger tools before offensive AI becomes widespread enough to put even more pressure on already strained security teams.

Key recommendations from the coalition

• Stronger baseline security standards across industries
• Wider access to defensive AI tools, especially for underfunded organizations
• Tougher security requirements for AI-generated code
• More investment in automated vulnerability detection and patching

For a deeper look at how AI is reshaping the threat landscape, check out AI-powered phishing attacks and cybersecurity automation trends.

Why the window may be short

AI doesn’t need to invent entirely new cyberattacks to make the situation worse. Helping attackers find existing vulnerabilities faster could be enough to make familiar security failures much more expensive. That still doesn’t turn every attack into an AI superweapon. Unpatched software and understaffed security teams remain ordinary problems, but automation can make exploiting them faster and easier to repeat.

The coalition wants organizations to strengthen those defenses now, before AI-powered attacks become commonplace. For anyone already struggling to keep systems patched and secure, waiting until attackers have better automation leaves even less room to catch up.

The message is clear: the time to prepare is now, not after the first major AI-driven breach makes headlines.

Lambda’s latest chip-buying loan

Lambda, the AI cloud company that buys expensive chips and rents them out by the hour, just pulled off another big debt raise. This time it’s $1 billion in private, short-dated debt to buy Nvidia AI chips that will be leased to Microsoft, according to Bloomberg.

The deal was arranged by JP Morgan Chase. The terms tell you a lot about how confident Lambda is in its ability to flip these chips into revenue quickly. Short-dated debt means the company expects to deploy the GPUs, start generating cash flow, and pay the loan back fast.

This isn’t a one-off. It’s part of a pattern.

In May, Lambda closed a $1 billion secured credit facility. This week, it announced the closing of a $926 million loan to fund Nvidia GB300 GPUs — one of Nvidia’s newest chip models — for a deployment it’s already under contract to provide to Nvidia itself.

So in roughly six months, that’s nearly $3 billion in debt stacked on top of its existing venture capital.

Why Lambda keeps borrowing instead of raising equity

The simple answer: speed and dilution. Selling new shares would give investors a slice of future upside. Debt, especially short-dated debt tied to specific customer contracts, lets Lambda keep more of the equity while locking in the hardware it needs to fulfill deals.

It’s a financing model that looks a lot like what airlines do with aircraft, or what shipping companies do with vessels. The asset — in this case, a rack of GPUs — is the collateral. The customer contract is the promise that the cash will flow.

Bloomberg reports the $1 billion private debt deal comes as Lambda is reportedly in talks for a $3 billion pre-IPO round. That’s a big number, but it’s not surprising given the company’s trajectory. Last November, Lambda raised $1.5 billion in venture capital at a $5.43 billion post-money valuation, per PitchBook data.

If the pre-IPO round closes at the rumored size, Lambda’s valuation could jump significantly. The debt, however, is the more interesting story here.

The Microsoft angle

Leasing chips to Microsoft is a marquee customer win. It signals that Lambda can compete for hyperscaler-scale workloads, not just startups and research labs. Microsoft doesn’t rent GPUs from just anyone. The fact that Lambda is borrowing $1 billion to buy hardware specifically for Microsoft suggests a long-term, high-value contract.

It also means Lambda is carrying the execution risk. If the chips arrive late, if deployment slips, if utilization underperforms — the debt still needs to be repaid.

The $400 billion AI debt wave

Lambda isn’t alone in this game. According to data compiled by Bloomberg, banks and tech companies have raised over $400 billion in AI-related debt globally in 2026 so far.

That number is staggering. It includes everything from hyperscaler bonds to project financing for data centers to specialized loans like Lambda’s. The AI boom has become a debt boom.

Why? Because the demand for compute is growing faster than companies can fund it with cash flow or equity alone. Building AI infrastructure is capital-intensive in a way that few industries have ever matched. And with Nvidia’s newest chips — like the GB300 — costing hundreds of thousands of dollars per unit, even well-funded companies need leverage.

The risk in the model

Short-dated debt works beautifully when everything goes as planned. Chips get deployed, customers pay, loans get repaid, and everyone moves on to the next round.

But it’s fragile. If AI demand softens, if a major customer renegotiates, if chip delivery timelines slip — the math gets ugly fast. Debt doesn’t wait for the market to recover.

There’s also the question of what happens when these chips become obsolete. Nvidia’s roadmap moves quickly. A GPU that’s cutting-edge today can be mid-tier in two years. Lambda’s ability to repay short-dated debt depends on keeping utilization high and pricing competitive.

What this means for the AI chip market

Lambda’s aggressive borrowing is a bet that AI compute demand stays red-hot. It’s also a bet that Nvidia’s chip supply keeps flowing. If Nvidia can’t deliver, Lambda’s contracts — and its debt obligations — become very uncomfortable.

The good news for Lambda: it’s not just buying chips on spec. The Microsoft deal is contracted. The Nvidia GB300 deployment is contracted. This is debt tied to committed revenue, which is a much safer position than borrowing to build infrastructure and hoping customers show up.

Still, the scale is worth pausing on. A company that was valued at $5.43 billion last November is now borrowing $1 billion at a time for single deployments. That’s aggressive leverage by any standard.

The road to IPO

The reported $3 billion pre-IPO round would give Lambda more equity cushion before it hits public markets. That’s probably wise, given the debt load it’s carrying.

Public investors tend to be skittish about companies with heavy short-term debt, even if it’s tied to customer contracts. A strong equity round would help Lambda tell a better story: we have the contracts, we have the hardware, and we have a balance sheet that can weather hiccups.

Whether the IPO happens this year or next, Lambda’s financing strategy will be a case study. Some will call it brilliant — using cheap debt to scale faster than competitors. Others will call it reckless — borrowing short-term against assets that depreciate as fast as they compute.

The truth is probably somewhere in between. What’s certain is that Lambda is playing to win, and it’s using every tool available to get the chips it needs.

The autonomy problem no one talks about

Enterprises are handing AI agents more freedom every quarter. Agents now plan, decide, and act across systems without a human approving each step. That shift raises a question that belongs at the center of every architecture review: When an agent tries to do something it was never authorized to do, what actually stops it?

These are your agents, running on your models, touching your data in your infrastructure. The responsibility for their actions sits with you. That responsibility can’t be met in hindsight, and it can’t be met with abstract policies that live on paper but not in practice. Agents need rules in the context of the moment, because they don’t exercise overriding judgment about their own actions.

Consider a simple rule: Never open the car door. Followed literally, an agent could never get in or out of the car at all. But change the context — a crash, a fire, someone hurt and needing to escape — and the rule you actually want is the opposite. Context in the moment is everything. We’re asking agents to do intelligent things; that requires intelligent rules.

Why guardrails around the agent aren’t enough

The instinct is to add guardrails: instructions, policies, and monitoring layered above the model. Those mechanisms matter, but they share a structural limit. The car-door rule is plausible right up until the moment you actually have to decide whether to open the door.

Controls at the agent layer are only as reliable as the agent’s output is predictable. Autonomy is precisely the property that makes that output hard to predict. Governance that depends on reviewing an action before it happens cannot keep pace with a system that acts in milliseconds, across many systems at once.

Governance has to become executable. And it has to be enforced where agents actually do their work: at the operational data layer, in the context, and exactly at the moment it is happening.

The data layer is the enforcement point

Agents create value by touching data. They query it, retrieve it, transform it, and increasingly act on it. A policy that says an agent should not reach a certain class of data is meaningful only if the system can deny that access at the moment the agent requests it.

Similarly, a principle that AI must be auditable is meaningful only if the organization can reconstruct what the agent did, what data it touched, which user it acted for, and what resulted. When governance lives at the data layer, it holds regardless of how the agent was built or how it behaves. The control is a property of the database itself, not a promise made by the agent.

Agent behavior is probabilistic. Governance cannot be

The enterprise should not rely on a model choosing to follow policy. The policy has to be enforced by the system. That is the difference between hoping an actor stays in bounds and constructing bounds it cannot cross to begin with.

The controls that make this real are ones many enterprises already run at the data layer:

• Role- and attribute-based access control
• Row- and column-level security
• Classification and masking
• Policy as code
• Complete audit trails

What agents change is not the mechanism, but who the mechanism has to recognize. Identity management has to treat the agent as a principal in its own right, with its own identity and a purpose declared when the session opens. Once purpose is bound to identity, the policy engine can evaluate it the same way it evaluates role or department today. The record of what happened can capture not just who acted and what they touched, but what they declared they were there to do.

Nine controls under three imperatives

In practice, this resolves into nine controls, grouped under three imperatives.

Enforce it

• Role- and attribute-based access control enforced at query time, for agents as well as users
• Dynamic column masking driven by the same policy path
• Agent identity as a first-class principal, with declared purpose bound at session start and the acting user preserved

See it and prove it

• Classification and tagging that drives policy
• Session-level audit logging that records which agent acted, for which user, and under what declared purpose
• Lineage across pipelines, so a result can be traced back to the request that produced it

Unify and harden

• Centralized, portable policy management
• Encryption at rest and in transit
• Consistent enforcement across on-prem, cloud, and sovereign or air-gapped environments

“Declared purpose is what makes the difference,” says Priyanka Jain, VP of product management for data & AI governance at EDB. “It becomes an attribute the access layer already understands, evaluated in the same policy path as role and row-level security. The enforcement mechanism does not change. What changes is that the agent’s purpose is part of what it evaluates, and part of what the record proves afterward.”

A digital leash, not a locked door

The goal is not to stop agents from doing useful work. It is to define how far an agent can go, what it can touch, what it can change, what requires escalation, and how the organization can reconstruct events if something goes wrong.

Governed this way, agents are identified, scoped, monitored, and auditable. The enterprise can adopt them faster, because security, risk, and leadership teams trust the operating model underneath. That trust is what lets you move aggressively on AI rather than cautiously around it.

Open, sovereign, and enforceable at the source

Built on open source Postgres, this open foundation keeps enterprises in control of where their data lives, who can reach it, and under what policy — without ceding governance to a layer they don’t own or can’t inspect. For regulated industries, that combination of data sovereignty and source-level enforcement isn’t a nice-to-have; it’s the precondition for putting agents into production at all.

Agentic systems will keep getting more capable and more autonomous. That is a reason to be deliberate about where control lives, not a reason to slow down. The enterprises that enforce governance at the data layer can move fast on AI, because the thing protecting their data is more than just wishful thinking.

For a deeper look at the full framework, including how to implement these controls in your own stack, see EDB’s white paper Governing Agentic AI at Enterprise Speed. And if you’re still weighing how to approach AI agent security or database access control, the data layer is the right place to start.

Max Romanenko is Chief Technology Officer at EDB.