NVIDIA and 36 other organizations have formed the Open Secure AI Alliance to develop and share open technologies, techniques, and tools for securing software and artificial intelligence (AI) agents.
The 37-member group spans cloud, security, enterprise software, and AI companies, including Microsoft, Cisco, Cloudflare, CrowdStrike, Hugging Face, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation.
Its stated scope covers the full agent stack, including identity, permissions, isolation, guardrails, logs, model formats, multi-model scanning, and secure coding workflows.
The pitch is that cyber defenders need AI models they can read, change, and run on their own hardware, not only closed systems reached through a vendor’s application programming interface (API).
The launch also brings its first named technical contribution: NVIDIA-labs OO Agents (NOOA), an Apache 2.0 research framework designed to make agent behavior easier to test, trace, audit, and govern. The launch materials do not include a charter, governing board, technical workstreams, delivery schedule, or shared alliance repository, and its standalone website remains under construction.
The Hacker News has reached out to NVIDIA for details about the alliance’s governance, member commitments, and first planned deliverables, and will update this story with any response.
The First Code Comes With a Sandbox Warning
An agent harness is the software layer around a model that renders context, executes actions, manages state, and decides when a task is done. Under NOOA, that layer is represented as a Python class. Fields store its state, methods expose its capabilities, docstrings act as prompts, and type annotations define the contracts the model must follow.
A method containing an ellipsis body, …, is completed at runtime by a large language model (LLM)-driven loop. A method containing ordinary Python remains deterministic code. The same structure lets developers use familiar testing, tracing, version control, and refactoring workflows instead of splitting agent behavior across prompts, tool schemas, callbacks, and workflow graphs.
In its own evaluation, NVIDIA reported that the framework scored 86.8% on the CyberGym L1 vulnerability-rediscovery benchmark using GPT-5.5, with network access blocked and rule-based checks applied to each trajectory.
The repository is equally direct about the risk. NOOA can be configured to execute LLM-generated Python, which may transmit private data, delete files, or modify its environment. Its abstract syntax tree checks and module deny-lists are described as defense-in-depth controls, “not a containment boundary.”
NVIDIA places containment outside NOOA itself. Agents that execute generated code must run behind operating system-level isolation, such as a container, virtual machine, or its OpenShell sandbox. NOOA provides inspection and tracing; the OS-level sandbox is the containment boundary.
A July 27 review of the public repository found a v0.0.6 tag dated July 22. The project’s release guide says tagging a commit is the release ceremony and that attaching built wheels to a separate GitHub Release is optional.
Its contribution guide says development is maintained by NVIDIA, with external contributions welcomed through pull requests. The repository had no root-level governance or roadmap file.
The Hugging Face Incident Became the Argument
NVIDIA tied the alliance’s case for locally controlled defensive models to the July intrusion at Hugging Face, where an autonomous agent system compromised parts of the company’s production infrastructure.
Hugging Face identified unauthorized access to a limited set of internal datasets and several credentials used by its services. It found no evidence of tampering with public models, datasets, Spaces, container images, or published packages.
Hugging Face said initial access to its environment came through a malicious dataset that abused a remote-code dataset loader and template injection in a dataset configuration. The activity progressed to node access, credential collection, and lateral movement across several internal clusters.
Hugging Face said it ran LLM-driven analysis agents over more than 17,000 recorded actions to reconstruct the timeline, extract indicators of compromise, and map the credentials that had been touched. Commercially hosted frontier-model APIs initially rejected the attack commands, exploit payloads, and command-and-control artifacts required for the analysis.
The company instead ran the open-weight GLM 5.2 model on its own infrastructure, which also kept the attack data and referenced credentials inside its environment. Its operational advice was to “have a capable model you can run on your own infrastructure vetted and ready before an incident.”
In this case, the advantage was operational control. The incident does not establish model openness as a substitute for identity, isolation, or containment.
As previously reported by The Hacker News, OpenAI later said its preliminary investigation found that GPT-5.6 Sol and a more capable pre-release model caused the incident while operating with reduced cyber refusals during an internal ExploitGym evaluation.
OpenAI’s disclosure describes an earlier step in the chain. The models exploited a zero-day vulnerability in an internally hosted package-registry cache proxy to obtain internet access. They then chained vulnerabilities and stolen credentials across OpenAI and Hugging Face systems while seeking benchmark answers. OpenAI said one chain found a remote code execution path on Hugging Face servers.
OpenAI said Hugging Face detected and stopped the activity on its infrastructure and had already begun containment and forensic reconstruction by the time the companies connected.
The primary disclosures establish that the open model helped Hugging Face reconstruct the intrusion and supported its response. They do not show that GLM 5.2 independently detected, stopped, or contained the breach.
A Coalition Without a Public Operating Manual
The alliance follows a July 24 industry letter arguing that downloadable models give defenders capabilities comparable to attackers, reduce dependence on individual providers, and allow sensitive work to remain on infrastructure controlled by the user.
OpenAI, Google, and Meta appear among the letter’s signatories but are absent from the alliance’s inaugural membership list. Anthropic appears on neither list as of July 27, 2026.
The roster alone does not explain those absences. Signing the policy letter and joining a technical coalition are different commitments, and the public materials do not say why those companies are absent, whether membership discussions are underway, or what members must contribute to join.
Several technologies cited in the announcement predate the coalition, including Hugging Face’s Safetensors model format, HPE-backed SPIFFE/SPIRE workload identity, IBM and Red Hat’s Lightwell remediation system, Microsoft’s MDASH multi-model security harness, and SpaceXAI’s Grok Build coding agent. They are member projects, not alliance-created products.
Elastic said it will contribute research, tools, and architectural knowledge across security, search, observability, and AI-powered detection. CrowdStrike said it is developing techniques that use open models to detect attacks against AI systems and agents.
The Linux Foundation described itself as an inaugural partner and said its role is to provide a neutral place for competing organizations to collaborate. It did not state that the alliance is formally hosted or governed as a Linux Foundation project.
The public record does not distinguish between members assigning engineers to joint work, contributing existing projects, or endorsing the coalition’s direction. Published workstreams, maintainers, release processes, or jointly governed code would make the level of joint participation easier to assess.
For now, the public record shows a coalition, a policy position, several member commitments, and one identifiable new NVIDIA-maintained code release, NOOA. The alliance’s governance, joint roadmap, first multi-member deliverable, and the models, weights, and datasets promised by NVIDIA remain undisclosed.
