Nvidia's AI Security Alliance Hits 120 Firms
Nvidia's week-old AI security alliance already has draft rules on the table.
The Open Secure AI Alliance (OSAA) passed 120 member companies inside its first week, and its first working group — the Shared AI Findings Exchange, or SAFE — has proposals out for open comment. The Linux Foundation, itself a member, is administering that comment process. The drafts cover how to report an AI security incident confidentially, how to warn the parties it affects, and how to run a blame-free analysis afterward so everyone learns from it.
At a glance
· OSAA is about a week old and already lists more than 120 member companies.
· SAFE, its first working group, has proposals open for public comment, administered by the Linux Foundation.
· Members are cataloging existing open source: Nvidia's Garak LLM vulnerability scanner, Okta's agent identity work, Red Hat's agent governance, and Amazon's Strands Agents and Cedar.
· Adobe, BlackRock, Cisco, Intel, Microsoft, Visa, and Hugging Face are members. Anthropic, OpenAI, and Google are not.
· The proposals came together while members were in Las Vegas for Black Hat this week.
Nvidia CEO Jensen Huang. Nvidia championed the open letter that produced the Open Secure AI Alliance and spearheads the group, which passed 120 member companies in its first week.
What SAFE Actually Proposes
SAFE's first drafts are process documents, not technology. They describe three things: a way to report an AI cybersecurity incident in confidence, a way to alert the organizations that incident touches, and a blame-free post-mortem so the finding turns into shared knowledge instead of a lawsuit.
Anyone who has worked in security recognizes that shape. It is roughly the CVE and CERT playbook — coordinated disclosure, downstream notification, honest write-ups — pointed at a class of system that does not fit the old templates. A buffer overflow lives in a version number. A model that can be talked into exfiltrating data does not.
Nothing here is earth-shattering, and that is arguably the point. Industry groups that start with grand technical standards tend to stall; ones that start with a reporting format and a neutral place to file it sometimes survive long enough to matter.
The Linux Foundation's role is the detail worth noticing. Nvidia convened the alliance, and a vendor-run disclosure channel is a hard sell to Intel, Microsoft, and Cisco. Handing administration to a neutral foundation is what makes filing a finding a reasonable thing for a competitor to do.
Code Already on the Table
Alongside the paperwork, members are contributing and cataloging pieces of open source they already ship. This is the half of the effort most likely to produce something an enterprise can actually run.
Member
Contribution
What it does
Nvidia
Garak, plus an open model family
An open source vulnerability scanner that probes large language models for failure modes
Okta
Agent identity
Work on giving autonomous agents identities that systems can actually verify
Red Hat
Agent governance
Control over what an agent is permitted to do once it is running
Amazon
Strands Agents
An open source toolkit for building agents
Amazon
Cedar
An authorization language for writing access policy as code
Read the column on the right and a stack starts to suggest itself: identity for the agent, policy for what it may touch, a scanner for the model behind it, and a shared channel for reporting what went wrong. TechCrunch notes there are many more contributions beyond these.
If those pieces do converge, the outcome is an open source path to securing agents rather than a product line. That is a meaningful difference for any company that has watched a security category get bundled and repriced.
Agents as the Attacker
The threat model here runs in both directions. The alliance is aimed at defending the agents an enterprise deploys, and at defending against agents pointed the other way — the kind of rogue AI attacker exemplified by the OpenAI model that infiltrated Hugging Face.
Hugging Face is a member of this group, which is a small but telling fact. The platforms that get attacked and the vendors that build the attacking primitives are increasingly the same set of companies, and an incident exchange only works if both sides of that overlap are inside it.
Shared reporting matters more for agents than for conventional software because agent failures generalize. A technique that talks one agent framework into misbehaving often works on the next one, since the weakness sits in how models handle untrusted input rather than in any one vendor's code.
Who Joined and Who Passed
In the alliance
Not in the alliance
Nvidia, Adobe, BlackRock, Cisco, Intel, Microsoft, Visa, Okta, Red Hat, Amazon, Hugging Face, the Linux Foundation — 120+ companies total
Anthropic, OpenAI, Google
The absences are the interesting part. OpenAI and Google both signed the original open letter that spawned this group — the one Nvidia championed, published last week, signed by over 200 tech companies, urging the White House to support open source AI rather than restrict it. Neither has joined the alliance it produced.
Anthropic signed neither the letter nor the group, which surprises no one who follows the company's public positioning on open weights. OpenAI and Google are the harder cases: both have released open weight models of their own, and Google has a long record as an open source supporter.
Signing a policy letter costs a signature. Joining a standards body means committing engineers, filing incident reports, and accepting a shared process — a much larger ask this early. Whether the two labs join as the group builds momentum is the open question.
What Set the Clock Running
This all moved fast because of policy, not research. It has been only a couple of weeks since news broke that the Trump administration was considering a ban on Chinese open weight models — the consternation that followed produced the open letter, and the letter produced the alliance.
The counter-argument from inside the open ecosystem is that restriction is the wrong instrument. The co-founder and chief technology officer of Arcee, a U.S. open weight AI lab, argues that the way to beat any threat Chinese labs pose — real or imagined — is a stronger American open ecosystem rather than a smaller one.
"Openness may be one of the most important paths to AI safety and security," the group wrote in its letter. A week later it has a working group, published drafts, and a neutral administrator, which is a faster answer than most industry bodies manage in a year.
What Changes for Security Teams
Nothing to adopt this week. The proposals are open for comment, not ratified, and no vendor is shipping against them yet. But there are three concrete things worth doing while they are still in draft.
First, if you run agents in production, read the incident reporting draft during the comment window rather than after. Reporting formats are hardest to change once they ship, and the fields that get chosen now will decide what you are able to disclose later without exposing more than you intend.
Second, check your own stack against that contribution table. If your agents already sit on Cedar or Strands Agents, you have a head start on whatever governance layer emerges, and you should know that before your vendor tells you.
Third — and this is a reading of the trajectory, not a stated commitment — the blame-free analysis language is the piece your legal team should look at. Whether a shared post-mortem process survives contact with liability counsel is the thing most likely to determine if any of this works.
The Short Version
An industry group that is one week old has a working group, published drafts, and a neutral administrator, which is unusually fast for this kind of body. The proposals themselves are modest — reporting, notification, blame-free review — but the parallel effort to catalog members' existing open source is what could turn into a usable stack. The three labs missing from the roster are the ones to watch next.