AI security incidents are usually handled behind closed doors. A company investigates the problem, fixes what it can and moves on. The rest of the industry may never hear what failed, how the attack unfolded or which safeguard proved useless.
A new proposal backed by NVIDIA, the Linux Foundation and members of the Open Secure AI Alliance wants to change that.
The Shared AI Findings Exchange, or SAFE, would create a confidential framework for reporting AI security incidents and near misses. The goal is not to publish every breach or expose affected companies. It is to identify repeated failures and turn those lessons into practical security guidance that other organisations can use.
Open Secure AI Alliance Opens SAFE Proposal for Review
The Linux Foundation published a Request for Comments for the proposed SAFE Working Group on August 4, 2026.
The draft was developed by contributors from NVIDIA, Cisco, CrowdStrike, Hugging Face, Red Hat and other members of the Open Secure AI Alliance. It is now open for feedback from AI developers, cloud providers, researchers, security teams, infrastructure operators and standards bodies.
SAFE is still a proposal. There is no final specification yet, which matters. The group is asking the wider security community to help decide how incident reports should be handled, who should govern the system and what information can safely be shared.
That approach also keeps one company from controlling the process.
The proposal calls for independent governance representing different parts of the AI ecosystem. Its rules would apply to both open and proprietary AI systems rather than favouring a particular model provider or technology stack.
SAFE Guidelines Focus on Incidents and Near Misses
A major AI failure does not always begin with a dramatic breach.
An agent might access a tool it should never have reached. A safeguard could fail under an unusual prompt. Sensitive information might appear in a log. An automated workflow may take an unauthorised action, only for a human operator to catch it before serious damage occurs.
Those near misses can reveal just as much as a successful attack.
Under the SAFE proposal, organisations could confidentially report incidents and close calls for collaborative analysis. The framework would look for recurring weaknesses across models, tools, runtime environments, monitoring systems, supply chains and human operating procedures.
The emphasis is on learning rather than assigning blame.
Affected organisations would still need to be notified, and participants would remain responsible for their existing legal, contractual and regulatory obligations. SAFE would sit around those responsibilities, not replace them.
AI Agents Create a Much Wider Attack Surface
Securing an AI agent is not the same as scanning a chatbot for unsafe answers.
AI agents can call APIs, browse internal systems, retrieve credentials, write code and trigger business processes. Some operate with limited supervision. That turns identity controls, permissions, guardrails, logs and tool access into part of the security boundary.
A strong model can still become part of a weak system.
NVIDIA argues that protection has to cover the full agent stack, from the model and its surrounding harness to the runtime environment and the tools it is allowed to use. The Open Secure AI Alliance is building open and inspectable technologies across those layers.
This is where SAFE could become useful. Incident reports would not stop at saying an AI model behaved badly. Reviews could examine which permission was too broad, which monitoring alert arrived too late or which operational assumption failed.
That level of detail is far more valuable to security teams.
NVIDIA Adds Open Tools Across the AI Security Stack
NVIDIA is contributing several technologies to the alliance, including the NVIDIA Labs Object-Oriented Agent research harness.
Known as NOOA, the framework is designed to make agent behaviour easier to test, trace, audit and govern. NVIDIA OpenShell, another part of the company’s security stack, restricts what an agent can access and which actions it can perform.
The company is also contributing open model families and security tools.
Garak allows developers to scan large language models for prompt injection, data leakage and jailbreak vulnerabilities. NeMo Guardrails helps teams enforce safety policies, while NeMo Anonymizer and NeMo Safe Synthesizer are aimed at sensitive-data protection and privacy-safe synthetic data.
NVIDIA’s verified agent skills add controls at the capability level. The skills are scanned for threats such as prompt injection and tool poisoning, documented through skill cards and cryptographically signed so teams can detect whether a package was changed after publication.
It is a lot of moving parts. That is precisely the point. Agent security will not be solved by one scanner sitting beside the model.
Amazon, Microsoft and Visa Join the Open Security Push
Other alliance members are bringing their own projects into the shared defensive stack.
Amazon, one of the newer Open Secure AI Alliance members, is contributing Strands Agents, an open-source toolkit for building and evaluating AI agents. It is also contributing Cedar, an authorisation language that can place deterministic boundaries around what agents are permitted to do.
Microsoft has opened several AI red-team and evaluation tools. PyRIT helps security teams automate AI red-teaming exercises, while Assert converts natural-language safety requirements into executable evaluations.
Visa has joined the alliance with its open-source Vulnerability Agentic Harness. Capital One has contributed VulnHunter, and Cloudflare is offering its Vulnerability Discovery Harness as an open-source agent skill.
The list stretches across identity, code security, runtime controls, observability and incident response. It is not one neat product suite. It is closer to a community toolbox.
Specialised AI Models Take on Cyber Defence
The alliance is also pushing specialised security models rather than relying only on general-purpose AI.
Cisco has introduced tools including DefenseClaw, an agentic governance layer built on NVIDIA OpenShell, along with Antares security models that can identify known vulnerabilities inside codebases.
CrowdStrike is fine-tuning NVIDIA’s Nemotron Nano model for cyber-defence work. According to the company’s internal testing, the model reached 96% accuracy when generating investigation queries for Falcon LogScale.
Mistral has released Shieldstral, a multimodal safety classifier available as open weights under the Apache 2.0 licence.
These projects are built for narrower jobs: investigating alerts, finding vulnerable code, enforcing runtime rules or classifying risky content. That can make them easier to evaluate than a general model expected to handle everything.
Shared Reporting Could Produce Reusable AI Defences
The SAFE proposal is not limited to written recommendations.
Where appropriate, the working group could publish reusable tests, machine-readable policies, detection rules, secure reference configurations and incident-response guidance. A failure discovered inside one company could eventually become a test that hundreds of other organisations run before deploying a similar system.
That would be a meaningful shift.
Cybersecurity teams already exchange vulnerability disclosures and threat intelligence, although the process is rarely perfect. AI agents introduce new failure patterns that existing reporting systems may not capture well, especially when the problem involves a chain of prompts, model decisions, tool calls and human approvals.
SAFE is an attempt to build that missing layer before agent deployments spread much further.
Whether companies will report their most uncomfortable mistakes remains the hard part. Confidentiality and neutral governance may help. Useful guidance will depend on receiving detailed reports rather than polished summaries that reveal little.
The proposal is now sitting in a public GitHub repository. The security community gets to shape what comes next.
