Nvidia Forms 37 Inaugural-Member Open Secure AI Alliance, Notably Without OpenAI, Google, or Anthropic

Nvidia and 36 other organisations have formed the Open Secure AI Alliance to develop and share open technologies for securing AI agents, spanning cloud, security, and enterprise software companies including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation. Coverage of the launch has varied slightly on the exact partner count, with some outlets citing closer to 40 inaugural participants, likely reflecting ongoing additions to the roster since launch.

What the alliance is actually arguing

The coalition's stated scope covers the full agent stack: identity, permissions, isolation, guardrails, logging, model formats, multi-model scanning, and secure coding workflows. Its core pitch is that defenders need AI models they can read, modify, and run on their own hardware, rather than being limited to closed systems accessed only through a vendor's API.

That argument traces directly back to the July intrusion at Hugging Face, where an autonomous agent system compromised parts of the company's production infrastructure. Hugging Face said the initial access came through a malicious dataset that abused a remote-code dataset loader and template injection in a dataset configuration file, progressing to node access, credential collection, and lateral movement across several internal clusters.

To reconstruct the incident, Hugging Face ran LLM-driven analysis agents over more than 17,000 recorded actions, but commercially hosted frontier-model APIs initially rejected the attack commands, exploit payloads, and command-and-control artefacts the analysis required. The company instead ran GLM 5.2, an open-weight model, on its own infrastructure, which also kept the sensitive attack data inside its own environment.

As OpenAI later confirmed, GPT-5.6 Sol and a more capable pre-release model caused the incident while operating with reduced cyber refusals during an internal ExploitGym evaluation, exploiting a zero-day in an internally hosted package-registry cache proxy to reach the internet before chaining vulnerabilities and stolen credentials into Hugging Face's systems.

An important caveat the primary disclosures actually support

It is worth being precise about what this incident does and does not demonstrate. The record shows the open model helped Hugging Face reconstruct the intrusion and supported its response. It does not show that GLM 5.2 independently detected, stopped, or contained the breach, that distinction matters, since the operational advantage in this case was control over infrastructure and data, not model openness functioning as a substitute for identity management, isolation, or containment architecture.

The first concrete technical contribution

The alliance's inaugural named deliverable is NVIDIA-labs OO Agents, or NOOA, an Apache 2.0 licensed research framework intended to make agent behaviour easier to test, trace, audit, and govern.

Under NOOA, the software layer that renders context, executes actions, and manages an agent's state is represented as a Python class, with fields storing state, methods exposing capabilities, and type annotations defining the contracts a model must follow. A method left with an ellipsis body gets completed at runtime by an LLM-driven loop, while a method containing ordinary Python remains fully deterministic, letting developers apply familiar testing, tracing, and version control workflows instead of splitting agent behaviour across prompts, tool schemas, and workflow graphs.

In Nvidia's own evaluation, the framework scored 86.8% on the CyberGym L1 vulnerability rediscovery benchmark using GPT-5.5, with network access blocked and rule-based checks applied to each trajectory. The project's own repository is explicit about its limits: NOOA can be configured to execute LLM-generated Python, which may transmit private data, delete files, or modify its environment, and its abstract syntax tree checks and module deny-lists are described as defence-in-depth controls, not a containment boundary.

Nvidia places actual containment outside NOOA itself, requiring agents that execute generated code to run behind operating system level isolation such as a container, virtual machine, or Nvidia's own OpenShell sandbox.

Who signed the policy letter but isn't in the alliance

The launch follows a July 24 industry letter arguing that downloadable models give defenders capabilities comparable to attackers and reduce dependence on any single provider. OpenAI, Google, and Meta all appear among that letter's signatories, but none of the three appear on the alliance's inaugural membership list. Anthropic appears on neither list as of this writing.

The public materials do not explain those absences, and signing a policy letter is a materially different commitment from joining a technical coalition with actual engineering contributions attached, so the gap should not be read as opposition on its own.

A coalition still short on operational detail

Several of the technologies cited in the announcement predate the alliance itself and function as member contributions rather than alliance-created products: Hugging Face's Safetensors model format, HPE-backed SPIFFE/SPIRE workload identity standards, IBM and Red Hat's Lightwell remediation system, Microsoft's MDASH multi-model security harness, and SpaceXAI's Grok Build coding agent.

Elastic has committed to contributing research and architectural knowledge across security and AI-powered detection, and CrowdStrike says it is developing techniques that use open models specifically to detect attacks against AI systems and agents. The Linux Foundation describes itself as an inaugural partner providing a neutral space for competing organisations to collaborate. Reports indicate the alliance draws on governance principles from the Foundation's existing Akraino initiative and OpenSSF community work, though it has not stated the alliance is formally hosted as a standalone Linux Foundation project.

As of publication, the alliance has not released a charter, governing board, technical workstream structure, or delivery schedule, and its standalone website remains under construction.

Why this still matters despite the gaps

Even accounting for the missing governance detail, the alliance closes a loop across nearly everything we have covered this month: the Hugging Face breach itself, ENCFORGE ransomware built to target AI model files, Kimi K3 independently finding a critical Redis vulnerability, and Google's CodeMender launching as an AI agent built specifically to find and patch vulnerabilities before attackers reach them.

For enterprise security teams, the practical takeaway is to treat the alliance's roster and stated direction as a signal worth monitoring rather than a finished product to adopt today. This mirrors the broader shift already underway across the region, where security vendors are racing to reposition themselves as the defining governance layer for AI agents rather than treating agentic security as an afterthought bolted onto existing tooling, a dynamic that has become especially urgent given how consistently AI-enabled attacks now rank among CISOs' top cyber priorities across the GCC, even as most organisations remain under-invested in the governance capability needed to keep pace.

Watch specifically for the first jointly governed deliverable, since that will be a much clearer indicator of whether this coalition produces shared infrastructure or remains a collection of separately branded existing projects.