INDEPENDENT COMMUNITY DASHBOARD · UPDATED: 18 OCT 2026
A living, single-page tracker mapping the open AI security stack, SAFE RFC progress, member updates, curated open-source tools, and primary sources.
BACKGROUND & MISSION
The public case is practical: during the July 2026 Hugging Face security incident, closed AI tools blocked essential forensics. An open-weight model run on their own infrastructure helped analyze tens of thousands of actions and contain the intrusion.
The Alliance’s stated mission is to give defenders open models, harnesses, and tools they can inspect, adapt, and control — complementing closed systems rather than replacing them. It builds on Linux Foundation Akrites work and the OpenSSF community.
01 // REVERSE-CHRONOLOGICAL FEED
Dated changelog of material updates, RFC milestones, tool releases, and membership expansion.
ClickHouse joins the alliance to help build open tools that keep AI agents secure, contributing open instrumentation for agent forensics, open evaluation pipelines, and reference architectures for air-gapped agent observability.
OpenShell v0.1.3 released with improvements including optional cluster-scoped RBAC and supervisor session retries.
Scorecard v5.6.0 released with migration to AboutCode Foundation infrastructure and workflow enhancements.
The Open Secure AI Alliance, now comprising over 120 organizations, is presenting a new framework for sharing incidents involving agentic AI. The Linux Foundation released a Request for Comments for the Shared AI Findings Exchange (SAFE), which aims to translate AI agent incidents into shared defense measures. Members will collect and analyze incidents confidentially, notify affected parties, identify recurring failure points, and publish recommendations to reduce systemic risk.
Driven Tech joins the Open Secure AI Alliance and contributes an AI Security RFC focusing on securing agentic systems, AI workflows, and emerging autonomous technologies.
NVIDIA detailed its AI agent security framework centered on OpenShell runtime software and Sentry hardware monitoring, providing controls for agent behavior, network, and file access.
The Linux Foundation announced that the deadline to contribute to the Shared AI Findings Exchange (SAFE) Request for Comments has been extended to October 7, allowing more time for community feedback on the proposed framework for securing AI systems. The SAFE RFC is hosted on GitHub at https://github.com/OpenSecureAIAlliance/RFCs.
Cisco's family of small, open-weight AI models for vulnerability localization, Antares, was highlighted in CNBC reporting, emphasizing their efficiency and accessibility for security teams.
Members of the Open Secure AI Alliance are developing the Shared AI Findings Exchange (SAFE) guidelines to turn agentic AI security incidents into shared protection. The guidelines focus on confidential reporting, collaborative analysis, and evidence-based recommendations to reduce systemic risk.
Shared AI Findings Exchange draft framework active for public comment. Review ongoing discussions on incident reporting protocols.
SUSE pledges commitment to open sovereign AI infrastructure, Linux kernel security boundaries, and hardened runtime environments.
Draft incident-reporting framework for AI agents and foundation models released under Linux Foundation stewardship.
NVIDIA, Hugging Face, AWS, and Linux Foundation announce open defense stack to secure AI models, data pipelines, and agent runtimes.
02 // INCIDENT REPORTING FRAMEWORK
Current state of the Shared AI Findings Exchange (SAFE) RFC initiative under Linux Foundation stewardship.
Comment Deadline: Sept 1, 2026 · GitHub Activity: 42 open issues, 14 active PRs
Major Community Feedback Themes:
03 // OPEN BUILDING BLOCKS
Curated directory of open-source frameworks, security sandboxes, format standards, and identity engines.
Agent harness for testing, tracing, auditing, and governing AI agents. Integrates foundation models with control systems.
Safe, ultra-fast tensor storage format preventing arbitrary code execution risk during model weight loading.
Zero-trust cryptographic identity standard and runtime for heterogeneous cloud workloads and agent microservices.
Isolated runtime sandbox and kernel security wrapper for safe sub-agent execution and untrusted LLM tool calls.
LLM vulnerability scanner probing foundation models for prompt injection, jailbreaks, hallucination, and data leakage.
Expressive language for fine-grained access control policies and authorization logic in automated agent workflows.
High-throughput and memory-efficient LLM serving engine featuring PagedAttention and secure model execution.
Automated security health check tool evaluating open-source code repositories for risk mitigation standards.
04 // ECOSYSTEM GROWING QUICKLY
Tracking membership expansion from initial 37 partners to 120+ participating organizations.
🔥 Recently Joined (Last 2–3 Weeks):
Inaugural & Major Partners:
NVIDIA · Hugging Face · AWS · Linux Foundation · OpenSSF · Palo Alto Networks · Cisco · Google Cloud · Microsoft · Meta · IBM · Cloudflare · Databricks · Dell · HPE · Elastic · LangChain · Palantir · Salesforce · SAP · Siemens · Snowflake · Adobe · ServiceNow
View Official Full Partner List on NVIDIA Blog ↗05 // PRESS DIGEST
Curated roundup of high-signal reporting on sovereign AI security and alliance milestones.
Onyxia Cyber joins the alliance to bring insights on accelerating AI-driven cyber governance, automating exposure mitigation, and building resilient security programs on a foundation of trusted data. Read the announcement.
ClickHouse joins the alliance to help build open tools that keep AI agents secure, contributing open instrumentation for agent forensics, open evaluation pipelines, and reference architectures for air-gapped agent observability. Read the announcement.
OpenShell v0.1.3 released with improvements including optional cluster-scoped RBAC and supervisor session retries. Read the release.
Scorecard v5.6.0 released with migration to AboutCode Foundation infrastructure and workflow enhancements. Read the release.
The Open Secure AI Alliance, now comprising over 120 organizations, is presenting a new framework for sharing incidents involving agentic AI. The Linux Foundation released a Request for Comments for the Shared AI Findings Exchange (SAFE), which aims to translate AI agent incidents into shared defense measures. Members will collect and analyze incidents confidentially, notify affected parties, identify recurring failure points, and publish recommendations to reduce systemic risk. Read the announcement.
Driven Tech joins the Open Secure AI Alliance and contributes an AI Security RFC focusing on securing agentic systems, AI workflows, and emerging autonomous technologies. Read the announcement.
ClickHouse is joining the Open Secure AI Alliance to help build open tools that keep AI agents secure, leveraging its columnar database for agent trace storage and observability. Read the announcement.
NVIDIA detailed its AI agent security framework centered on OpenShell runtime software and Sentry hardware monitoring, providing controls for agent behavior, network, and file access.
The Linux Foundation announced that the deadline to contribute to the Shared AI Findings Exchange (SAFE) Request for Comments has been extended to October 7, allowing more time for community feedback on the proposed framework for securing AI systems. The SAFE RFC is hosted on GitHub at View SAFE RFC on GitHub.
Cisco's family of small, open-weight AI models for vulnerability localization, Antares, was highlighted in CNBC reporting, emphasizing their efficiency and accessibility for security teams. Watch CNBC coverage.
Members of the Open Secure AI Alliance are developing the Shared AI Findings Exchange (SAFE) guidelines to turn agentic AI security incidents into shared protection. The guidelines focus on confidential reporting, collaborative analysis, and evidence-based recommendations to reduce systemic risk. Read the announcement.
NVIDIA introduced the Open Agent Safety Platform, combining OpenShell runtime software and the Sentry reference design to provide full-stack governance and control for AI agents from testing to deployment. The platform includes in-silicon monitoring via NVIDIA BlueField-4 DPUs and is backed by over 100 industry partners including Anthropic, Cisco, and Hugging Face. Read the announcement.
NVIDIA announced the inaugural partners of the Open Secure AI Alliance, including major tech companies, to develop open AI security tools and techniques. Read the announcement.
The Open Secure AI Alliance has joined the Linux Foundation to create a neutral home for open AI security tools and standards, strengthening collective defense across the AI stack. Read the announcement.
Elisity joins the Open Secure AI Alliance to help advance open source tools and standards for AI safety and cyber defense, focusing on least privilege for sanctioned agents, containment of agentic threats, and identification of unsanctioned AI. Read the announcement.
Box has become a founding member of the Open Secure AI Alliance, contributing to open AI security tooling and governance. Read the announcement.
06 // DIRECT LINKS
Prefer these direct primary sources over summaries when accuracy matters.
07 // FREQUENTLY ASKED QUESTIONS
Short answers to common questions about the alliance and this community guide.
No. This is an independent community guide. Official information lives on NVIDIA’s blog, partner posts, and NVIDIA’s Alliance contact form.
A multi-company initiative announced July 27, 2026 to develop and share open technologies, techniques, and tools that help secure software and AI agents — so defenders can inspect, adapt, and run capable systems themselves.
Public materials cite rising AI-enabled threats and the Hugging Face incident, where closed tools blocked forensics and an open-weight model helped defenders respond on their own infrastructure.
No. The stated framing is that defenders need both open and closed systems. Open tools add transparency, localization, and control; closed models remain part of the ecosystem.
Start with NOOA on GitHub for agent harness research, Safetensors for safer weight formats, and SPIFFE/SPIRE for workload identity. Use the official NVIDIA form if you want to express interest in joining the Alliance.
Use NVIDIA’s official contact page. This site cannot enroll partners and does not speak for the Alliance.
Not at the time of writing. This page notes domain interest for an independent community home. Official branding and domains belong to the Alliance and its members if and when they publish them.
08 // CONTACT & FEEDBACK
Interested in osaa.ai / osaa.dev, or have a correction for this guide? Reach out on X.
@lviswanath on X ↗