AI Leaders Propose SAFE Guidelines for Cybersecurity Transparency

<div id="bsf_rt_marker"></div><p><span style="font-weight: 400;">Members of the </span><a href="https://blogs.nvidia.com/blog/open-secure-ai-alliance/"><span style="font-weight: 400;">Open Secure AI Alliance</span></a><span style="font-weight: 400;"> — now more than </span><span style="font-weight: 400;">120</span><span style="font-weight: 400;"> organizations strong — are developing new guidelines to strengthen agentic AI cybersecurity as the annual Black Hat conference begins in Las Vegas today. </span></p> <p><a target="_blank" href="https://www.linuxfoundation.org/blog/proposing-the-safe-working-group-an-open-community-effort-to-improve-ai-security"><span style="font-weight: 400;">The Linux Foundation</span></a><span style="font-weight: 400;"> today shared a </span><a target="_blank" href="https://github.com/OpenSecureAIAlliance/RFCs"><span style="font-weight: 400;">Request for Comments</span></a><span style="font-weight: 400;"> on Shared AI Findings Exchange (SAFE), a proposed set of guidelines designed to turn agentic cybersecurity incidents into shared protection for the entire ecosystem.</span></p> <p><span style="font-weight: 400;">The SAFE guidelines are being drafted by an Open Secure AI Alliance working group. NVIDIA, Cisco, </span><span style="font-weight: 400;">CrowdStrike</span><span style="font-weight: 400;">, </span><span style="font-weight: 400;">Hugging Face</span><span style="font-weight: 400;"> and </span><span style="font-weight: 400;">Red Hat</span><span style="font-weight: 400;"> are among Open Secure AI Alliance members working with the Linux Foundation to contribute to the initial proposal.</span></p> <p><span style="font-weight: 400;">The SAFE guidelines include proposals to confidentially collect and analyze AI incidents and near misses, inform those impacted, identify recurring control failures and publish evidence-based operating recommendations that reduce systemic risk.</span></p> <p><span style="font-weight: 400;">Cybersecurity is a race without a finish line. Every major technology shift has created new potential attack surfaces. Defenders must move now at agent speed to respond rapidly to protect infrastructure and intellectual property — and the best way to do that is together. When trusted ecosystems share threat intelligence openly, collective defense becomes a force multiplier.</span></p> <h2>Open Secure AI Alliance Delivers More Tools for AI Cybersecurity</h2> <p><span style="font-weight: 400;">The SAFE framework adds to technology contributions Open Secure AI Alliance members are making as part of a shared commitment to building and sharing open, inspectable tools across the full AI security stack.  </span></p> <p><span style="font-weight: 400;">An AI agent isn’t just a model. It’s a system — identity controls, harnesses, guardrails, logs and evaluation — and securing it requires more than vulnerability scanning. </span></p> <p><span style="font-weight: 400;">Security has always been strongest in the layers — and in the community’s willingness to share what it knows. The hardest problems get solved when defenders learn from each other, openly and at speed. </span></p> <h2>Full Stack of Open NVIDIA Cybersecurity Software and Models</h2> <p><span style="font-weight: 400;">NVIDIA’s contributions run the length of the stack, starting with the </span><a target="_blank" href="https://developer.nvidia.com/blog/six-agent-harness-capabilities-for-higher-model-performance/?ncid=prsy-823400"><span style="font-weight: 400;">NVIDIA Labs Object-Oriented Agent (NOOA)</span></a><span style="font-weight: 400;"> research harness, on </span><a target="_blank" href="https://github.com/NVIDIA-NeMo/labs-OO-Agents/tree/main"><span style="font-weight: 400;">GitHub</span></a><span style="font-weight: 400;"> — which makes agent behavior easier to test, trace, audit and govern.</span><span style="font-weight: 400;"> </span></p> <p><span style="font-weight: 400;">The </span><a target="_blank" href="https://developer.nvidia.com/blog/run-autonomous-self-evolving-agents-more-safely-with-nvidia-openshell/"><span style="font-weight: 400;">NVIDIA OpenShell</span></a><span style="font-weight: 400;"> runtime restricts what an agent can see, touch and do — enforcing security and privacy controls at the agent level, so an agent can’t reach what it shouldn’t. </span></p> <p><span style="font-weight: 400;">NVIDIA’s open model families — </span><a target="_blank" href="https://www.nvidia.com/en-us/ai-data-science/foundation-models/nemotron/"><span style="font-weight: 400;">NVIDIA Nemotron</span></a><span style="font-weight: 400;"> for agentic AI, </span><a target="_blank" href="https://www.nvidia.com/en-us/ai/cosmos/"><span style="font-weight: 400;">NVIDIA Cosmos</span></a><span style="font-weight: 400;"> for physical AI, </span><a target="_blank" href="https://developer.nvidia.com/project-gr00t"><span style="font-weight: 400;">NVIDIA Isaac GR00T</span></a><span style="font-weight: 400;"> for robotics, </span><a target="_blank" href="https://www.nvidia.com/en-us/industries/healthcare-life-sciences/"><span style="font-weight: 400;">NVIDIA BioNeMo</span></a><span style="font-weight: 400;"> for healthcare and life sciences, and </span><a href="https://blogs.nvidia.com/blog/alpamayo-2-super-open-model-now-available"><span style="font-weight: 400;">NVIDIA Alpamayo</span></a><span style="font-weight: 400;">, the world’s largest model for autonomous vehicles licensed for commercial use — ship with open weights, datasets and training techniques. </span></p> <p><span style="font-weight: 400;">NVIDIA open source </span><a target="_blank" href="https://developer.nvidia.com/blog/nvidia-verified-agent-skills-provide-capability-governance-for-ai-agents/"><span style="font-weight: 400;">verified agent skills</span></a><span style="font-weight: 400;"> extend that trust to the capability layer. </span></p> <p><span style="font-weight: 400;">Each skill provides portable instruction sets — cataloged, scanned for risks such as prompt injection and tools poisoning, cryptographically signed and documented with a skill card. Defenders know exactly what an agent skill does, where it came from and whether it was modified after publication.</span></p> <p><span style="font-weight: 400;">NeMo Guardrails, NeMo Anonymizer and NeMo Safe Synthesizer help enforce safety policies, protect sensitive data and generate privacy-safe synthetic data.</span></p> <p><span style="font-weight: 400;">And </span><a target="_blank" href="https://github.com/NVIDIA/garak"><span style="font-weight: 400;">Garak</span></a><span style="font-weight: 400;">, NVIDIA’s open source LLM vulnerability scanner, lets security teams check models for data leaks, prompt injections and jailbreak scenarios before they ship. </span></p> <h2>Alliance Members Expand Tools for Open Ecosystem Development</h2> <p><span style="font-weight: 400;">Other members of the Open Secure AI Alliance have also been building across the full defensive stack, spanning identity and permissions, harnesses, runtime guardrails, security AI models, observability and evaluation, data security and privacy, availability and resilience, and more. </span></p> <p><span style="font-weight: 400;">Some of the latest contributions across different layers of the stack are highlighted below, with more continuing to arrive.</span></p> <h2>Identity and Permissions — Who Gets to Act</h2> <p><span style="font-weight: 400;">You can’t secure what you can’t identify. </span></p> <p><span style="font-weight: 400;">Okta</span><span style="font-weight: 400;"> is developing reference implementations for agent identity and access, showing how </span><a target="_blank" href="https://xaa.dev/"><span style="font-weight: 400;">Cross App Access</span></a><span style="font-weight: 400;"> (XAA), an open protocol, enables AI agents operating in OpenShell sandbox environments to securely connect to enterprise applications.</span></p> <p><span style="font-weight: 400;">Palo Alto Networks </span><span style="font-weight: 400;">has contributed open source tools from Idira, its next-generation identity security platform, including </span><a target="_blank" href="https://github.com/cyberark/agent-guard"><span style="font-weight: 400;">Agent Guard</span></a><span style="font-weight: 400;"> and </span><a target="_blank" href="https://github.com/cyberark/agentwatch"><span style="font-weight: 400;">Agent Watch</span></a><span style="font-weight: 400;">. These tools help developers and agent builders apply identity security best practices and safe guards such as securely retrieving secrets for agentic workflows. </span></p> <p><span style="font-weight: 400;">A new open source project founded by</span><span style="font-weight: 400;"> Red Hat</span><span style="font-weight: 400;">, </span><a target="_blank" href="https://redhat.com/en/about/press-releases/red-hat-launches-asago-community-automate-ai-safety-and-governance-policy-production"><span style="font-weight: 400;">asago</span></a><span style="font-weight: 400;"> takes an organization’s custom governance requirements — such as those referenced in NIST, OWASP and the EU AI Act — and maps them directly to what agents are allowed to do at runtime, with a single audit trail from policy clause to live control.</span></p> <h2>Harnesses and Tooling — How Security Work Gets Orchestrated</h2> <p><span style="font-weight: 400;">AI agents are more than a model – they tap into systems of open and closed models, harnesses, tools and runtimes to get work done.</span></p> <p><span style="font-weight: 400;">If a model is the agent’s brain, the harness is the body that takes action by using tools. The harness surrounding the model acts like an orchestrator that determines how agents are deployed, coordinated and constrained. </span></p> <p><span style="font-weight: 400;">Alliance members are contributing tooling, harnesses and supporting technologies across this emerging layer of the AI security stack.</span></p> <p><span style="font-weight: 400;">Amazon</span><span style="font-weight: 400;">, which today became one of the newest members of the Open Secure AI Alliance, contributes </span><a target="_blank" href="https://github.com/strands-agents"><span style="font-weight: 400;">Strands Agents</span></a><span style="font-weight: 400;">, an open source toolkit for building AI agents that is open at every layer, giving developers full visibility into agent behavior and the ability to evaluate agentic systems in production. Amazon also contributes </span><a target="_blank" href="https://cedarpolicy.com/en"><span style="font-weight: 400;">Cedar</span></a><span style="font-weight: 400;">, an open source authorization language that enforces deterministic, verifiable boundaries on what AI agents are permitted to do, giving customers fine-grained, analyzable access controls to help ensure only authorized actions reach enterprise resources.</span></p> <p><a target="_blank" href="https://www.capitalone.com/tech/open-source/announcing-vulnhunter/"><span style="font-weight: 400;">Capital One</span></a><span style="font-weight: 400;"> open sourced </span><a target="_blank" href="https://github.com/capitalone/vulnhunter"><span style="font-weight: 400;">VulnHunter</span></a><span style="font-weight: 400;"> for agentic AI code security.</span></p> <p><span style="font-weight: 400;">Cloudflare </span><span style="font-weight: 400;">is offering its </span><a target="_blank" href="https://blog.cloudflare.com/build-your-own-vulnerability-harness/"><span style="font-weight: 400;">Vulnerability Discovery Harness</span></a><span style="font-weight: 400;"> as an open source skill to add security to agent systems.</span></p> <p><span style="font-weight: 400;">Microsoft</span><span style="font-weight: 400;"> AI Red Team has open sourced several tools and harnesses. </span><a target="_blank" href="https://github.com/microsoft/PyRIT"><span style="font-weight: 400;">PyRIT – Python Risk Identification toolkit</span></a><span style="font-weight: 400;"> enables AI red teamers to run automated red teaming, with built in memory, supporting common targets, as well as custom endpoints. </span></p> <p><a target="_blank" href="https://www.microsoft.com/en-us/security/blog/2026/05/20/introducing-rampart-and-clarity-open-source-tools-to-bring-safety-into-agent-development-workflow/"><span style="font-weight: 400;">RAMPART</span></a><span style="font-weight: 400;"> turns red-team findings and real-world incidents into repeatable tests that run as software changes. </span><a target="_blank" href="https://www.microsoft.com/en-us/security/blog/2026/05/20/introducing-rampart-and-clarity-open-source-tools-to-bring-safety-into-agent-development-workflow/"><span style="font-weight: 400;">Clarity</span></a><span style="font-weight: 400;"> helps teams question design assumptions and identify potential failures before code is written.</span></p> <p><span style="font-weight: 400;">Microsoft has also open sourced</span><a target="_blank" href="https://github.com/responsibleai/ASSERT"> <span style="font-weight: 400;">Assert</span></a><span style="font-weight: 400;">, which converts natural language requirements and expected AI safety and security behaviors into executable evaluations.</span></p> <p><a target="_blank" href="https://www.wiz.io/blog/atlas-ai-vulnerability-researcher"><span style="font-weight: 400;">Atlas</span></a><span style="font-weight: 400;"> is </span><span style="font-weight: 400;">Wiz&#8217;s </span><span style="font-weight: 400;">autonomous vulnerability research engine that orchestrates specialized AI agents to discover and validate security flaws across code and open source packages.</span></p> <p><span style="font-weight: 400;">Visa </span><span style="font-weight: 400;">has also joined the Open Secure AI Alliance, contributing its open sourced </span><a target="_blank" href="https://corporate.visa.com/en/sites/visa-perspectives/security-trust/visa-cybersecurity-mythos-project-glasswing.html"><span style="font-weight: 400;">Visa Vulnerability Agentic Harness</span></a><span style="font-weight: 400;"> to help teams identify issues, support remediation and validation, quickly and safely.</span></p> <h2>Models — Intelligence Built for AI Safety and Defense</h2> <p><span style="font-weight: 400;">Not every security or safety task calls for a general-purpose model. Specialized security and safety models are purpose-built for defense: trained to understand code, locate vulnerabilities and reason about threats at scale. They can work to support agentic workflows as systems of models, with both open and closed models working together to get the job done efficiently.</span></p> <p><span style="font-weight: 400;">Cisco </span><span style="font-weight: 400;"><a target="_blank" href="https://blogs.cisco.com/ai/cisco-announces-defenseclaw">DefenseClaw</a> is an open source agentic governance layer that sits on top of NVIDIA OpenShell to provide robust, automated security at the runtime level when scaling agentic workforces. Cisco has also released two of its </span><a target="_blank" href="https://blogs.cisco.com/ai/introducing-antares-the-most-efficient-open-weight-ai-models-for-vulnerability-localization"><span style="font-weight: 400;">Antares</span></a><span style="font-weight: 400;"> security small language models to help pinpoint where known vulnerabilities exist within a codebase; and </span><a target="_blank" href="https://blogs.cisco.com/ai/announcing-new-framework-securing-ai-generated-code"><span style="font-weight: 400;">Project CodeGuard</span></a><span style="font-weight: 400;"> to embed secure-by-default practices directly into AI coding workflows.</span></p> <p><span style="font-weight: 400;">CrowdStrike</span><span style="font-weight: 400;"> is fine-tuning the NVIDIA Nemotron Nano model for cyber defense. Internal testing achieved 96% accuracy in generating investigation queries within Falcon LogScale, delivering a natural-language interface that boosts agent investigative efficiency. CrowdStrike has also published research demonstrating how a specialized NVIDIA Nemotron Nano reasoning model outperforms much larger models on Security Operations Center detection triage while introducing calibrated logit-based confidence to enable measurable, tunable, and auditable autonomous security decisions.</span></p> <p><span style="font-weight: 400;">Seeing what an agent did is only part of the picture. Defenders also need to understand why it acted, whether the system behaves safely and how attacks are evolving in the real world. </span></p> <p><a target="_blank" href="https://www.akamai.com/blog/news/thinking-outside-black-box-defenders-open-source-ai"><span style="font-weight: 400;">Akamai</span></a> <span style="font-weight: 400;">brings insights from its </span><a target="_blank" href="https://www.akamai.com/security-research/the-state-of-the-internet"><span style="font-weight: 400;">State of the Internet reports</span></a><span style="font-weight: 400;"> and </span><a target="_blank" href="https://www.akamai.com/security-research"><span style="font-weight: 400;">Security Intelligence Group research</span></a><span style="font-weight: 400;">, drawing on real-world data to illuminate AI-era threats and explain how emerging exploits work so defenders can learn, adapt and respond.</span><span style="font-weight: 400;">Cognition </span><span style="font-weight: 400;">has released a </span><a target="_blank" href="https://cognition.com/blog/measuring-open-source-model-trustworthiness"><span style="font-weight: 400;">trustworthiness evaluation</span></a><span style="font-weight: 400;">, which measures alignment and security risks of open source-derived models. The evaluation demonstrates these risks can be mitigated via post-training.  </span></p> <p><a target="_blank" href="https://research.perplexity.ai/articles/securing-agents-across-perplexity%E2%80%99s-client-endpoints-with-numbat"><span style="font-weight: 400;">Numbat</span></a><span style="font-weight: 400;"> is </span><span style="font-weight: 400;">Perplexity&#8217;s </span><span style="font-weight: 400;">open source agent security suite for client endpoints. It detects, investigates, and prevents agent activity across macOS, Linux and Windows — giving defenders a structured record of what agents actually did.</span></p> <p><span style="font-weight: 400;">Uber </span><span style="font-weight: 400;">open sourced key components of</span><a target="_blank" href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fuber%2FADR&amp;data=05%7C02%7Csmcphee%40nvidia.com%7C68be605362cc4f1e085f08def1a8d7cd%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C639213905000463800%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=Zo5onsG8wuh8mzvJdeh2bD8VS%2FCptVzEWiarAAi5TJE%3D&amp;reserved=0"><span style="font-weight: 400;"> ADR (Agentic AI Detection and Response)</span></a><span style="font-weight: 400;">, a production system that reconstructs the full causal chain of AI agent activity -– from prompt to reasoning, tool calls, and outcomes -– to help security teams detect threats. Today, ADR supports more than 200,000 agent sessions per day across 30,000 endpoints, using a two-tier analysis approach that combines efficient detection with deeper investigation for high-confidence threats. </span></p> <h2>Availability and Resilience — Rapid Recovery When Moments Count</h2> <p><span style="font-weight: 400;">Agent systems must remain dependable under disruption, contain failures and recover safely without losing critical state or exposing the broader environment.</span></p> <p><span style="font-weight: 400;">LangChain</span><span style="font-weight: 400;"> is adding resilience capabilities to its open source frameworks — Deep Agents, LangGraph and LangChain — enabling agents to retry interrupted work, follow a safe recovery path, resume from a saved state instead of starting over and automatically fall back to alternative models when the primary model fails.</span></p> <p><a target="_blank" href="https://www.veeam.com/blog/veeam-open-secure-ai-alliance.html"><span style="font-weight: 400;">Veeam</span></a> <span style="font-weight: 400;">helps organizations keep the data and infrastructure behind AI resilient and recoverable with technologies such as </span><a target="_blank" href="https://nam11.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.veeam.com%2Fcompany%2Fpress-release%2Fkasten-by-veeams-kanister-accepted-by-cloud-native-computing-foundation-cncf-as-sandbox-project.html&amp;data=05%7C02%7Cjenniec%40nvidia.com%7C38865c9cbaec44f0c21c08def16d8455%7C43083d15727340c1b7db39efd9ccc17a%7C0%7C0%7C639213650000221567%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&amp;sdata=SOiI%2B5zuQf2qrT8GhOAQ8Rhs509KIDGKX0Svf7jN2gk%3D&amp;reserved=0"><span style="font-weight: 400;">Kanister</span></a><span style="font-weight: 400;">, its open source framework for data protection on Kubernetes. It helps teams protect and recover AI workloads, vector databases, and data to a verified known-good state.</span></p> <p><img fetchpriority="high" decoding="async" class="aligncenter wp-image-97185 size-full" src="https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1.png" alt="" width="1920" height="1080" srcset="https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1.png 1920w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-960x540.png 960w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-1680x945.png 1680w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-1280x720.png 1280w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-1536x864.png 1536w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-1290x725.png 1290w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-630x354.png 630w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-300x169.png 300w, https://blogs.nvidia.com/wp-content/uploads/2026/08/osaia-logo-garden_press-kit_1920x1080-1-400x225.png 400w" sizes="(max-width: 1920px) 100vw, 1920px" /></p> <p><span style="font-weight: 400;">More contributions are coming. When members publish reusable mitigations, defenders across the ecosystem can inspect, adapt and improve them, helping security practices evolve as AI advances.</span></p> <p><span style="font-weight: 400;">Join members of the Open Secure AI Alliance at Black Hat today, Tuesday, Aug. 4, at 5:15pm PT, for a group photo outside the Main Stage, Business Hall at the Mandalay Bay Convention Center.</span></p> <p><a target="_blank" href="https://www.nvidia.com/en-us/open-secure-ai-alliance-contact-us/"><i><span style="font-weight: 400;">Learn more or share interest</span></i></a><i><span style="font-weight: 400;"> in joining the Open Secure AI Alliance.</span></i><i><span style="font-weight: 400;"><br /> </span></i></p>