A week-old industry coalition already moving from a signed letter to real open-source security tools and incident-reporting proposals is a concrete pace, and Engineering and Ops teams securing AI agents now have specific tools to evaluate, not just a group to watch.
- The Open Secure AI Alliance, an industry group spearheaded by Nvidia, has grown to more than 120 companies just one week after forming.
- The group’s new working group, SAFE, has already published proposals for confidential AI cybersecurity incident reporting, managed by the Linux Foundation.
- Members are contributing real open-source tools, including Nvidia’s Garak vulnerability scanner, Amazon’s Strands Agents and Cedar authorization language, and agent identity and governance work from Okta and Red Hat.
- Notable absences include Anthropic, OpenAI, and Google, even though OpenAI and Google signed the original open letter that spawned the group.
- Hugging Face, the company breached during OpenAI’s rogue agent incident last month, is a member of the alliance.
What Happened
The Open Secure AI Alliance, an industry group spearheaded by Nvidia, has grown to more than 120 companies just one week after forming. The group’s new working group, called the Shared AI Findings Exchange, or SAFE, has already published proposals for open comment, with the Linux Foundation managing the process.
The proposals cover how to confidentially report AI cybersecurity incidents, alert affected parties, and conduct blame-free analysis so the industry can learn from them. Members developed the proposals while gathered at the Black Hat security conference in Las Vegas this week.
Alliance members are also contributing real open-source tools. Nvidia offers an open model family and Garak, an open-source LLM vulnerability scanner, while Okta is building agent identity technology, Red Hat is working on agent governance, and Amazon has contributed its Strands Agents building tool and Cedar authorization language.
The group includes Adobe, BlackRock, Cisco, Intel, Microsoft, and Visa, along with Hugging Face, the company breached during OpenAI’s rogue agent incident last month. Notably absent are Anthropic, OpenAI, and Google, even though OpenAI and Google signed the original open letter that spawned the alliance.
Why It Matters
This is one of the first industry-wide efforts to standardize how AI security incidents get reported and shared, directly responsive to the pattern of agent-related breaches at OpenAI and Anthropic. For Engineering and Ops teams building or securing AI agents, the concrete tools already available, Garak, Strands Agents, Cedar, are worth evaluating now rather than waiting for the alliance’s broader framework to mature.
The absence of Anthropic, OpenAI, and Google is a real gap, since those three labs have produced most of the actual agent-security incidents this alliance is organizing around. Anthropic’s reluctance to join open-weight efforts is consistent with its past positioning, but a security standards body missing the labs most affected by the problem it’s solving is a meaningful limitation.
Openness may be one of the most important paths to AI safety and security. Open Secure AI Alliance
Bottom Line
Watch whether Anthropic, OpenAI, or Google eventually join formally, and whether SAFE’s incident-reporting proposals get real adoption beyond the founding members. The alliance’s origin, an open letter opposing Chinese model restrictions, also means its momentum could shift if that underlying policy debate resolves.
For engineering and security teams working with AI agents, per Relve, an AI tools intelligence platform, the practical move right now is to evaluate Garak, Strands Agents, and Cedar directly, they’re real, usable tools today, regardless of how the broader alliance develops.
