The Open Secure AI Alliance now counts more than 120 organizations as members, and the Linux Foundation just opened a public Request for Comments on a framework designed to turn agentic cybersecurity incidents into shared defense. The proposal, called Shared AI Findings Exchange or SAFE, dropped on August 4, 2026, the same day Black Hat opened in Las Vegas. The timing is not subtle. The alliance wants the security community talking about agent vulnerabilities before the next wave of breaches forces the conversation.
The alliance is shipping code, not just principles. Across six layers of the security stack, from identity and permissions to runtime guardrails and resilience, members have open sourced frameworks, models, and scanners that any team can inspect, deploy, or extend. NVIDIA, Cisco, CrowdStrike, Hugging Face, and Red Hat are among the working group members drafting the initial SAFE proposal, which would confidentially collect and analyze AI incidents and near misses, notify affected parties, identify recurring control failures, and publish evidence based recommendations.
If you are shipping AI agents into production, this matters because the security surface is already larger than most teams realize. As we have covered, 54% of enterprises have already been hit by agent related security incidents, and agentic MCP attacks bypass state of the art guardrails 58% of the time. The tools coming out of this alliance target the specific gaps behind those numbers.
What did the alliance actually ship?
The announcement from NVIDIA covers a full stack of contributions. Here is what is available now, organized by layer.
Identity and permissions. HPE is contributing to SPIFFE/SPIRE, a zero trust identity framework that can cryptographically verify AI agents and services. Okta is building reference implementations for Cross App Access, or XAA, an open protocol that lets agents in sandboxed environments securely connect to enterprise applications. Palo Alto Networks open sourced tools from its Idira identity security platform, including Agent Guard and Agent Watch, which help builders securely retrieve secrets for agentic workflows. Red Hat founded asago, a project that maps governance requirements from NIST, OWASP, and the EU AI Act directly to what agents are allowed to do at runtime, with a single audit trail from policy clause to live control.
Harnesses and tooling. Amazon, one of the newest alliance members, contributed Strands Agents (an open source agent toolkit with visibility at every layer) and Cedar (an authorization language that enforces deterministic, verifiable boundaries on what agents can do). Microsoft AI Red Team open sourced four tools: PyRIT for automated red teaming with built in memory, RAMPART for turning red team findings into repeatable tests that run on code changes, Clarity for questioning design assumptions before code is written, and Assert for converting natural language safety requirements into executable evaluations. The same announcement also included MDASH, a multi model scanning harness that orchestrates specialized agents to discover and prove exploitable bugs. Wiz contributed Atlas, an autonomous vulnerability research engine. Capital One open sourced VulnHunter for agentic code security. Cloudflare offered its Vulnerability Discovery Harness as an open source skill. Visa joined the alliance and contributed its Vulnerability Agentic Harness. SpaceXAI open sourced Grok Build, its terminal based AI coding agent, with plans to eventually open source the Grok model weights.
Models. NVIDIA shipped open weights for five model families: Nemotron for agentic AI, Cosmos for physical AI, Isaac GR00T for robotics, BioNeMo for healthcare and life sciences, and Alpamayo, described as the world's largest model for autonomous vehicles licensed for commercial use. Cisco released two Antares security small language models that pinpoint where known vulnerabilities exist within a codebase, plus DefenseClaw, a governance layer that sits on top of NVIDIA OpenShell to provide automated runtime security. CrowdStrike is fine tuning NVIDIA Nemotron Nano for cyber defense. Internal testing showed 96% accuracy in generating investigation queries within Falcon LogScale, and CrowdStrike published research showing that a specialized Nemotron Nano reasoning model outperforms much larger models on Security Operations Center detection triage.
Runtime and guardrails. NVIDIA OpenShell restricts what an agent can see, touch, and do at the runtime level. NeMo Guardrails, NeMo Anonymizer, and NeMo Safe Synthesizer enforce safety policies, protect sensitive data, and generate privacy safe synthetic data. Garak, NVIDIA's open source LLM vulnerability scanner, lets teams check models for data leaks, prompt injections, and jailbreak scenarios before deployment. NVIDIA's verified agent skills are portable instruction sets, each scanned for risks like prompt injection and tools poisoning, cryptographically signed, and documented with a skill card so defenders know exactly what a skill does and whether it was modified after publication.
Observability and evaluation. Uber open sourced ADR, or Agentic AI Detection and Response, a production system that reconstructs the full causal chain of agent activity from prompt to reasoning to tool calls to outcomes. It currently handles more than 200,000 agent sessions per day across 30,000 endpoints, using a two tier analysis approach that combines efficient detection with deeper investigation for high confidence threats. Perplexity contributed Numbat, an open source agent security suite for client endpoints on macOS, Linux, and Windows that detects, investigates, and prevents agent activity. Cognition released a trustworthiness evaluation measuring alignment and security risks of open source derived models, demonstrating that those risks can be mitigated through post training. Akamai is sharing insights from its State of the Internet reports and Security Intelligence Group research.
Resilience. LangChain added retry, recovery, and fallback capabilities to its Deep Agents, LangGraph, and LangChain frameworks, enabling agents to resume from saved state instead of starting over and automatically fall back to alternative models when the primary fails. Veeam contributed Kanister, a framework for data protection on Kubernetes that helps teams recover AI workloads, vector databases, and data to a verified known good state. IBM and Red Hat's Lightwell project extends security across the open source supply chain with digitally signed patches and automated vulnerability remediation at scale.
Why should builders care about these tools?
The tools address problems that most teams have not solved yet, and the ones who have solved them are using proprietary approaches that cannot be inspected.
The chart above shows the top contributors by number of open source tools, counted from the alliance announcement: NVIDIA leads with 12, Microsoft with 5, Cisco with 3, Amazon and Red Hat each with 2, and CrowdStrike with 1.
Here is what each gap means for your codebase:
- Agent identity is unsolved at most teams. Giving an agent an API key and hoping for the best is still the default. SPIFFE/SPIRE and Okta's XAA protocol give you cryptographic identity and scoped access, the same primitives you would use for human service accounts. If your agent touches a production database, it should have a verifiable identity, not a shared secret.
- Agent observability is a blind spot. Uber's ADR reconstructs what an agent did and why, from prompt to tool call to outcome. Without that causal chain, you cannot detect prompt injection, tool poisoning, or unauthorized actions after the fact. Most teams today have no agent level audit trail at all.
- Red teaming is manual and slow. Microsoft's PyRIT automates red teaming against your models and endpoints. RAMPART turns findings into regression tests that run on every code change. If you are not red teaming your agents before they ship, you are trusting that nobody will try prompt injection or jailbreaks.
- Open weights carry a real attack vector. Hugging Face's Safetensors format, donated to the PyTorch Foundation, guarantees that model weight files cannot execute arbitrary code. If you are downloading open weights from repositories, Safetensors closes a remote code execution hole. As our coverage of Hugging Face guardrail failures showed, the platform's security track record has real gaps.
- The EU AI Act is already forcing documentation. The transparency rules that took effect earlier this year require companies to document how their AI systems behave. The tools from this alliance give you a way to produce that documentation with real evidence rather than checklists.
The SAFE guidelines add a different layer: shared intelligence. If a prompt injection attack works against one team's agent, it probably works against yours. The framework proposes confidential incident collection, affected party notification, and published recommendations. Think of it as CVE for agents, but voluntary and confidential.
Which of these tools should you actually adopt?
Start with the tools that close your biggest gaps today, then work outward.
- If your agents run in production without identity controls, look at SPIFFE/SPIRE or Okta's XAA reference implementations. Agent identity is the foundation everything else builds on, and retrofitting it after a breach is painful.
- If you have no agent level audit trail, study Uber's ADR. It is a production system handling 200,000 sessions daily across 30,000 endpoints, not a research prototype. The architecture is directly applicable to any team running agents at scale.
- If you are shipping agents without red teaming, pull PyRIT and RAMPART into your CI pipeline. The cost of integration is low. The cost of not finding jailbreaks before users do is high.
- If you are downloading open model weights, insist on Safetensors format. It costs nothing and closes a real attack vector.
- If you are building on LangChain, the new resilience capabilities are worth integrating. Agents that crash and restart from zero are agents that lose money and data.
- If you run agent infrastructure, comment on the SAFE Request for Comments. The framework's shape will determine whether shared incident intelligence becomes useful or bureaucratic. If you have been hit by an agent security incident, your input on what should be reported and how is more valuable than you think.
Can the alliance sustain momentum beyond the launch?
The alliance launched on July 27, 2026 with dozens of founding members and crossed 120 organizations within two weeks. Amazon and Visa joined after the initial launch. More tools are arriving, and the SAFE guidelines are still in draft.
The bet the alliance is making is that open security tools will outpace closed ones, because defenders who can inspect and modify their tools will adapt faster than those who cannot. The bet against it is that openness cuts both ways: the same tools that help defenders help attackers scope their targets and understand defensive patterns.
There is also a governance question. 120 organizations contributing open source tools is a supply chain in itself. Who maintains these projects when the press cycle moves on? The Linux Foundation's involvement helps, but foundation governance does not guarantee that a tool stays maintained, secure, or compatible with your stack 18 months from now.
The regional angle matters too. The alliance's work on open models and sovereign AI has drawn attention from the Middle East, where Saudi Arabia and the UAE are consulting on AI cybersecurity guidelines and G42 is participating as an alliance member. Open security tooling is becoming part of the sovereign AI conversation, not just a developer convenience.
The real test is whether teams adopt before or after a breach
The alliance has done the easy part: shipping code and opening a comment period. The hard part is whether teams integrate these tools before or after their first agent breach. The tools are open, the guidelines are in draft, and the membership is growing. What happens next depends on whether builders treat agent security as a production requirement or a conference topic.
