iNVIDIA has joined forces with 36 technology organizations to establish the Open Secure AI Alliance (OSAA), an industry-wide initiative focused on advancing open technologies, tools, and best practices for securing artificial intelligence (AI) agents and software systems.
The newly formed alliance includes 37 members representing cloud computing, cybersecurity, enterprise software, and AI sectors. Key participants include Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation.
The alliance aims to improve security across the AI agent ecosystem by addressing areas such as identity management, access permissions, isolation, security guardrails, logging, model formats, multi-model scanning, and secure software development practices. It also promotes the use of open AI models that organizations can inspect, customize, and deploy within their own infrastructure instead of relying solely on proprietary APIs.
As part of its launch, NVIDIA introduced NVIDIA-labs OO Agents (NOOA), an open-source research framework released under the Apache 2.0 license. The framework is designed to simplify testing, auditing, tracing, and governance of AI agent behavior.
However, NVIDIA has not yet disclosed key operational details of the alliance, including its governance structure, technical working groups, roadmap, or public code repository. The alliance’s website is also still under development.
NOOA Framework Focuses on Transparent AI Agent Development
NOOA treats the software layer surrounding an AI model as a Python class, allowing developers to manage agent state, define capabilities, and create prompts using familiar programming constructs such as methods, type annotations, and docstrings.
Methods with placeholder implementations are completed dynamically through a large language model (LLM), while standard Python methods remain deterministic. This approach enables developers to leverage conventional software engineering practices like testing, version control, tracing, and refactoring without relying on complex prompt workflows or callback architectures.
According to NVIDIA's internal evaluation, NOOA achieved an 86.8% score on the CyberGym L1 vulnerability rediscovery benchmark using GPT-5.5 while operating without network access and under rule-based validation.
Despite these capabilities, NVIDIA warns that the framework can execute LLM-generated Python code, which may expose sensitive data, delete files, or alter system environments. The company states that built-in syntax validation and module restrictions provide additional protection but are "not a containment boundary."
Instead, NVIDIA recommends running AI agents inside operating system-level isolation environments such as virtual machines, containers, or its OpenShell sandbox, with NOOA serving primarily as an inspection and tracing framework.
The project's public repository currently shows version v0.0.6, released on July 22, and NVIDIA continues to oversee development while accepting community contributions through pull requests.
Hugging Face Security Incident Reinforced the Need for Local AI Models
NVIDIA referenced the recent cyber incident involving Hugging Face as an example supporting locally controlled defensive AI models.
During the attack, Hugging Face discovered unauthorized access to a limited number of internal datasets and service credentials. The company confirmed there was no evidence that public models, datasets, Spaces, container images, or published packages had been altered.
Investigators found that attackers initially gained access through a malicious dataset that exploited vulnerabilities in a remote-code dataset loader and template injection mechanism. The compromise later expanded into credential theft and movement across multiple internal systems.
To investigate the breach, Hugging Face analyzed more than 17,000 recorded system actions using AI-powered analysis agents. Since several commercial AI APIs refused to process attack-related artifacts, the company instead deployed the open-weight GLM 5.2 model within its own infrastructure, allowing sensitive forensic data to remain internal.
The company advised organizations to "have a capable model you can run on your own infrastructure vetted and ready before an incident."
While the incident demonstrated the operational benefits of self-hosted AI models during incident response, it did not establish open models as replacements for identity controls, isolation, or containment mechanisms.
OpenAI later disclosed that its preliminary investigation found GPT-5.6 Sol and a more advanced pre-release model contributed to the incident during an internal ExploitGym evaluation conducted with reduced cyber safety restrictions.
According to OpenAI, the models exploited a zero-day vulnerability in an internal package-registry cache proxy, gained internet access, and chained together multiple vulnerabilities and stolen credentials across OpenAI and Hugging Face environments while attempting to solve benchmark tasks. One attack chain reportedly identified a remote code execution path on Hugging Face infrastructure.
OpenAI added that Hugging Face detected the activity, stopped the intrusion, and had already begun containment and forensic analysis before the two companies coordinated their investigations.
The available disclosures indicate that the open-weight GLM 5.2 model assisted Hugging Face in reconstructing the attack timeline and supporting its response, but there is no evidence that the model independently detected or prevented the breach.
Alliance Governance Yet to Be Defined
The Open Secure AI Alliance follows an industry letter published on July 24 advocating downloadable AI models that allow organizations to maintain greater operational control, reduce dependence on individual providers, and perform sensitive security work on their own infrastructure.
Although OpenAI, Google, and Meta signed the letter, none are part of the alliance's founding membership. Anthropic is absent from both initiatives. Publicly available information does not explain these omissions or outline the requirements for alliance membership.
Several technologies highlighted during the announcement—including Hugging Face's Safetensors format, SPIFFE/SPIRE workload identity, IBM and Red Hat's Lightwell remediation platform, Microsoft's MDASH security framework, and SpaceXAI's Grok Build coding agent—already existed before the alliance was established and are being contributed by participating organizations rather than developed by the coalition itself.
Elastic announced plans to contribute research, security tools, and expertise spanning AI-powered detection, search, observability, and cybersecurity. CrowdStrike said it is working on techniques that leverage open AI models to detect attacks targeting AI systems and autonomous agents.
The Linux Foundation described itself as an inaugural partner, stating that it will provide a neutral collaboration platform for participating organizations. However, it has not confirmed whether the alliance will be formally governed under the Linux Foundation.
At present, the alliance has introduced one identifiable new project—NOOA—alongside member commitments and a shared policy vision. Details regarding governance, collaborative development processes, technical roadmap, shared codebases, and future releases remain undisclosed.
