Seven leading artificial intelligence (AI) companies — Amazon, Anthropic, Google, Inflection, Meta, Microsoft and OpenAI — have voluntarily pledged to take steps to ensure safety, security and transparency in AI development, according to the White House.

“These commitments, which the companies have chosen to undertake immediately, underscore three principles that must be fundamental to the future of AI — safety, security, and trust — and mark a critical step toward developing responsible AI,” the White House said.

The AI safety pledge focuses on three key areas: ensuring the safety of their products before release, building systems that put security first and winning the public's trust, which entails:

•  Internal and external security testing of AI systems before their release.
•  Sharing information across the industry and with governments, civil society and academia on managing AI risks.
• Facilitating third-party discovery and reporting of vulnerabilities in AI systems.
• Developing robust technical mechanisms to ensure that users know when content is AI generated, such as a watermarking system.
• Publicly reporting AI systems’ capabilities, limitations, and areas of appropriate and inappropriate use.

The Biden-Harris Administration noted it is “developing an Executive Order and pursuing bipartisan legislation” to regulate the AI industry.

These commitments have sparked a debate among cybersecurity experts about the effectiveness of the pledge on developing responsible AI.

Mike Parkin, senior technical engineer at Vulcan Cyber, highlighted the limits of a voluntary system, particularly against threat actors operating outside of legal and ethical boundaries.

“For organizations willing to follow the rules, it's possible to put guardrails in place that will keep generative AI from delivering false information. But for a threat actor who's using it specifically for the purpose? No,” he said in a statement.

“A voluntary system can work within the scope of ‘common usage,’ but it will only work for organizations that operate legitimately. I am far less concerned with one of the major players having flaws in their publicly available AI tools than I am with a hostile nation or cybercriminal organization building out their own capability and using it against the general public,” Parkin added.

Theus Hossmann, director of data science at Ontinue, also welcomed the push for security investment from AI companies, but he highlighted the vagueness of the current guidelines.

“The two commitments in the ‘Security’ section are: ‘Invest in cybersecurity and insider threat safeguards to protect proprietary and unreleased model weights’ and ‘Incent third-party discovery and reporting of issues and vulnerabilities.' Protecting their intellectual property from external attacks and insider threats is certainly in the best interest of any company, as well as the incentives for discovery and reporting of vulnerabilities,” Hossmann pointed out.

Additionally, he hinted that the true test would be the potential introduction of binding regulations for the AI industry. “More interesting will be the question whether AI will become a more heavily regulated industry with binding laws (like HIPAA [The Health Insurance Portability and Accountability Act] for health).”

On the other hand, Coalfire Field CISO Dave Randleman argues “the voluntary systems are just virtue signaling."

“All the companies signing onto the voluntary system are ultimately competitors against their industry peers. AI offers such a productivity boost that any advantage will be taken to produce a better AI product that can be leveraged against corporate rivals. Our biggest concern is the lack of transparency into AI applications, as they are often gatekept by intellectual property patents and held as trade secrets,” Randleman added.