What SAFE is designed to do

SAFE addresses a recurring problem in AI security: organizations may discover attacks, failures, or near misses independently, while other companies face similar risks without access to the lessons already learned.

The draft proposal focuses on four related practices:

• confidentially collecting and analyzing AI security incidents and near misses;
• notifying affected organizations when an incident is relevant to them;
• identifying recurring failures in controls and security practices; and
• producing blame-free, evidence-based lessons that can be used across the ecosystem.

The intended result is shared defensive intelligence. Instead of treating every prompt-injection, data-leakage, or rogue-agent incident as an isolated event, participants would have a process for turning individual failures into broader safeguards.

OSAA is building a security stack, not a single product

SAFE is only one part of OSAA’s approach. The alliance is also bringing together open-source and inspectable technologies intended to address different layers of agent security.

Reported contributions include:

• Nvidia: open-weight model families, OpenShell runtime controls for limiting what an agent can access or do, agent testing and auditing tools, and Garak, an open-source scanner for risks including data leakage, prompt injection, and jailbreaks.
• Okta: agent identity and access reference implementations using the Cross App Access protocol, with the goal of connecting agents to enterprise applications within more controlled environments.
• Red Hat: asago, an open-source governance project intended to connect organizational policies with runtime permissions and create an auditable path from policy to control.
• Amazon: Strands Agents, an open-source toolkit for building and evaluating agents, alongside Cedar, an authorization language.
• Other members: identity-focused projects such as Agent Guard and Agent Watch, reinforcing the idea that agent security requires more than model scanning alone.

Taken together, these projects cover identity, permissions, agent harnesses, runtime behavior, evaluation, data, governance, and resilience. They could eventually give enterprises a common set of controls for constraining and monitoring AI agents, including agents that behave maliciously or operate outside their intended scope. But that outcome remains a possibility, not an established result.

Who has joined OSAA—and who is missing?

Reports describe OSAA as having more than 120 organizations within its first week. Major participants cited include Nvidia, Adobe, BlackRock, Cisco, CrowdStrike, Hugging Face, Intel, Microsoft, Red Hat, and Visa; Amazon was described as a newer member.

The alliance followed a July 24 open letter urging U.S. policymakers to avoid broad or premature restrictions on open-weight AI models. The letter was initially backed by 25 companies, including Nvidia, Microsoft, Meta, IBM, Dell, Palantir, and Hugging Face. It argued that restricting downloadable models could undermine competition and push users toward Chinese AI systems as Washington considered its national-security response.

At the time of the Black Hat reporting, Anthropic, OpenAI, and Google were notable absences from OSAA. The relationship with the policy letter is more complicated: reporting differs on the later signatory list, with some accounts saying OpenAI and Google were subsequently added, while other reports describe them as absent from the original group. The available sources do not explain why those companies had not joined OSAA, so their absence should not be assigned a motive.

Why the alliance’s speed matters

OSAA’s central proposition is that openness and security do not have to be opposites. Open models, tools, evaluations, and incident lessons can give more defenders the ability to inspect failures, reproduce vulnerabilities, and adapt fixes. SAFE attempts to balance that transparency with confidentiality during incident collection and analysis, while sharing generalized lessons more broadly.

The alliance’s cross-industry composition could also help establish common interfaces and practices across model developers, cloud and infrastructure providers, identity specialists, security companies, and enterprise users. If those efforts mature, open AI systems may become easier for organizations to evaluate, control, and deploy responsibly.

That could support the broader policy case for open-weight AI as an American competitiveness issue, particularly as U.S. policymakers debate how to respond to Chinese AI labs. But OSAA has not yet demonstrated that it has improved U.S. competitiveness or reduced systemic AI risk. So far, its measurable achievement is narrower and more concrete: a 120-plus-member coalition has moved from open-AI advocacy to a public draft for coordinated AI security reporting, while members contribute tools that could form a more interoperable defense layer over time.

What SAFE is designed to do

SAFE addresses a recurring problem in AI security: organizations may discover attacks, failures, or near misses independently, while other companies face similar risks without access to the lessons already learned.

The draft proposal focuses on four related practices:

• confidentially collecting and analyzing AI security incidents and near misses;
• notifying affected organizations when an incident is relevant to them;
• identifying recurring failures in controls and security practices; and
• producing blame-free, evidence-based lessons that can be used across the ecosystem.

The intended result is shared defensive intelligence. Instead of treating every prompt-injection, data-leakage, or rogue-agent incident as an isolated event, participants would have a process for turning individual failures into broader safeguards.

OSAA is building a security stack, not a single product

SAFE is only one part of OSAA’s approach. The alliance is also bringing together open-source and inspectable technologies intended to address different layers of agent security.

Reported contributions include:

• Nvidia: open-weight model families, OpenShell runtime controls for limiting what an agent can access or do, agent testing and auditing tools, and Garak, an open-source scanner for risks including data leakage, prompt injection, and jailbreaks.
• Okta: agent identity and access reference implementations using the Cross App Access protocol, with the goal of connecting agents to enterprise applications within more controlled environments.
• Red Hat: asago, an open-source governance project intended to connect organizational policies with runtime permissions and create an auditable path from policy to control.
• Amazon: Strands Agents, an open-source toolkit for building and evaluating agents, alongside Cedar, an authorization language.
• Other members: identity-focused projects such as Agent Guard and Agent Watch, reinforcing the idea that agent security requires more than model scanning alone.

Taken together, these projects cover identity, permissions, agent harnesses, runtime behavior, evaluation, data, governance, and resilience. They could eventually give enterprises a common set of controls for constraining and monitoring AI agents, including agents that behave maliciously or operate outside their intended scope. But that outcome remains a possibility, not an established result.

Who has joined OSAA—and who is missing?

Reports describe OSAA as having more than 120 organizations within its first week. Major participants cited include Nvidia, Adobe, BlackRock, Cisco, CrowdStrike, Hugging Face, Intel, Microsoft, Red Hat, and Visa; Amazon was described as a newer member.

The alliance followed a July 24 open letter urging U.S. policymakers to avoid broad or premature restrictions on open-weight AI models. The letter was initially backed by 25 companies, including Nvidia, Microsoft, Meta, IBM, Dell, Palantir, and Hugging Face. It argued that restricting downloadable models could undermine competition and push users toward Chinese AI systems as Washington considered its national-security response.

At the time of the Black Hat reporting, Anthropic, OpenAI, and Google were notable absences from OSAA. The relationship with the policy letter is more complicated: reporting differs on the later signatory list, with some accounts saying OpenAI and Google were subsequently added, while other reports describe them as absent from the original group. The available sources do not explain why those companies had not joined OSAA, so their absence should not be assigned a motive.

Why the alliance’s speed matters

OSAA’s central proposition is that openness and security do not have to be opposites. Open models, tools, evaluations, and incident lessons can give more defenders the ability to inspect failures, reproduce vulnerabilities, and adapt fixes. SAFE attempts to balance that transparency with confidentiality during incident collection and analysis, while sharing generalized lessons more broadly.

The alliance’s cross-industry composition could also help establish common interfaces and practices across model developers, cloud and infrastructure providers, identity specialists, security companies, and enterprise users. If those efforts mature, open AI systems may become easier for organizations to evaluate, control, and deploy responsibly.

That could support the broader policy case for open-weight AI as an American competitiveness issue, particularly as U.S. policymakers debate how to respond to Chinese AI labs. But OSAA has not yet demonstrated that it has improved U.S. competitiveness or reduced systemic AI risk. So far, its measurable achievement is narrower and more concrete: a 120-plus-member coalition has moved from open-AI advocacy to a public draft for coordinated AI security reporting, while members contribute tools that could form a more interoperable defense layer over time.