Around 400 Scientists Call for International AI Oversight Body as Cybersecurity Risks Intensify

Approximately 400 scientists, including prominent artificial intelligence researchers Geoffrey Hinton and Yoshua Bengio, called on Tuesday, October 13, for an international body to oversee safety standards for advanced AI systems capable of carrying out cyber operations. In an open letter, the researchers proposed common containment standards, independent oversight and a registry of significant security incidents that could eventually be made public. They argued that voluntary commitments by technology companies are not enough to address risks associated with increasingly capable AI systems. The appeal comes as regulators in the United States and Europe intensify scrutiny of AI use in banking and cybersecurity.

Why researchers want international standards

Advanced AI systems can assist with software development, identify weaknesses in computer networks and automate tasks that previously required substantial human involvement.

These capabilities can have legitimate uses. Security teams may use AI to detect vulnerabilities, investigate suspicious activity and respond more quickly to cyber threats.

The same capabilities, however, could also be misused. Systems that can analyse code, identify weaknesses or coordinate complex digital tasks may lower the technical barriers for malicious actors. Risks become more difficult to manage when a system can take multiple actions with limited human supervision.

The researchers argue that safety standards should not depend entirely on the policies of individual companies. They want a more coordinated framework that establishes minimum expectations for containment, oversight and incident reporting across the industry.

Their proposal is a call for action, not an international regulatory body that already exists. Establishing such an institution would require governments and other stakeholders to agree on its authority, membership and operating rules.

The proposed role of containment standards

One of the letter’s central recommendations is that advanced AI models should initially be isolated from external networks, a practice commonly described as air-gapping.

The purpose is to limit the ways a system can interact with outside infrastructure while researchers evaluate its capabilities and potential risks.

Isolation alone cannot eliminate every danger. AI systems may still produce harmful outputs, and security failures can occur through people, connected tools or weaknesses in the surrounding software. Nevertheless, restricting network access can reduce the number of pathways through which a system could cause harm during testing.

The researchers also called for independent oversight. This would help ensure that assessments are not conducted solely by the organisations developing the technology, which may face commercial pressure to release products quickly.

Independent evaluation could provide a more consistent way to test whether systems remain within defined limits and whether safeguards work as intended.

Incident reporting could improve accountability

The proposed incident registry is another significant part of the initiative.

At present, information about AI-related security failures may be distributed across companies, cybersecurity researchers and affected organisations. Reporting practices can vary, making it difficult to compare incidents or understand whether particular weaknesses are recurring.

A shared registry could help researchers and regulators identify patterns, assess the severity of incidents and improve safety practices across the industry.

Making information public would require careful decisions about what can be disclosed. Detailed reports could help defenders understand vulnerabilities, but they could also expose technical information that malicious actors might exploit.

A workable system would therefore need rules covering confidentiality, verification, severity thresholds and the timing of public disclosure.

Regulators are already examining AI risks in banking

The appeal coincides with a separate regulatory push involving financial institutions.

Reuters reported on Tuesday that regulators in the United States, including the Federal Reserve, the Federal Deposit Insurance Corporation and the Office of the Comptroller of the Currency, are questioning banks about their use of advanced AI systems.

The inquiries include how banks use AI agents in cybersecurity, what limits are placed on their actions, whether decisions can be audited and how systems can be shut down if they exceed their authority.

European supervisors, including the European Central Bank and the Bank of England, are also pressing financial institutions to improve recovery plans and prepare for AI-enabled cyber threats.

The concern is not limited to the theft of customer data. A major attack affecting a bank or a critical service could disrupt payments, prevent customers from accessing accounts and undermine confidence in financial markets.

Regulators are still gathering information and have not, according to Reuters, imposed a new uniform set of requirements through these inquiries.

Innovation and control must develop together

Technology companies face pressure to deploy increasingly capable AI products, while businesses want to use automation to improve productivity and strengthen security.

However, the speed of adoption can outpace the development of appropriate controls. Organisations may introduce AI tools before they fully understand their dependencies, access permissions or failure modes.

For businesses, this creates practical questions: Which systems can an AI agent access? Can its actions be reversed? Is a human required to approve sensitive decisions? Can the organisation continue operating if the AI service becomes unavailable or compromised?

These are operational issues as much as technical ones. Effective AI governance requires clear responsibilities, testing, monitoring and plans for recovery.

The challenge of global coordination

An international oversight body could help establish common standards across countries, reducing the risk that companies face inconsistent expectations in different jurisdictions.

But reaching agreement would be difficult. Governments have different approaches to technology regulation, national security and information-sharing. Companies may also disagree about the costs and scope of mandatory oversight.

Some researchers and policymakers favour stronger international controls, while others argue that existing laws and technical safeguards should be improved before creating another institution.

The debate is therefore not simply about whether AI should be regulated. It is about how to make oversight effective without unnecessarily restricting beneficial research and development.

What happens next?

The scientists’ proposal adds pressure on governments and technology companies to move from general safety principles towards more concrete standards.

The next steps will depend on whether governments engage with the proposed framework, whether researchers can agree on practical containment requirements and whether companies are willing to disclose meaningful information about significant incidents.

For businesses adopting AI, the immediate lesson is clear: security planning cannot be separated from AI deployment. As systems gain greater autonomy, organisations will need stronger controls, better recovery procedures and clear accountability for decisions made with automated tools.

The call for international oversight does not settle the debate, but it signals growing concern that the governance of advanced AI must develop alongside its technical capabilities.