Contents
Cybersecurity
CISO-as-a-service consulting: posture, remediation roadmap, ongoing support.
Discover →
Artificial Intelligence
EU AI Act consulting: system classification, policies, AI governance, training.
Discover →
Admina Enterprise
AI governance: audit trail, PII redaction and bidirectional policies on any model, open-weight or proprietary, local or remote.
Explore Admina →
What was announced
On 27 July 2026 NVIDIA announced the Open Secure AI Alliance, a consortium to “develop and share open technologies, techniques and tools to safeguard software and agents in the AI era”. The Linux Foundation supplies the governance structure.
Beyond NVIDIA itself, the list published by NVIDIA carries thirty-six organisations: Adobe, Cadence, Capital One, Cisco, Cloudera, Cloudflare, Cognition, CrowdStrike, Databricks, Dell Technologies, DoorDash, Elastic, HPE, Hugging Face, IBM, LangChain, Linux Foundation, Microsoft, NAVER, NetApp, Nous Research, OpenClaw, Palantir, Palo Alto Networks, Red Hat, Reflection AI, Salesforce, SAP, ServiceNow, Siemens, SK Telecom, Snowflake, SpaceXAI, Synopsys, Thinking Machines Lab and TrendAI.
A note on method before going further: the member count varies with who reports it. NVIDIA’s post speaks of more than forty organisations, The Hacker News headlines on thirty-seven members, Help Net Security counts twenty-seven. There is only one named list and it is the one above. When a figure as simple as the number of founders comes out with three different values on day one, it usually means the press material was thinner than the announcement.
The founding argument
The case the alliance opens with is not abstract. It is the Hugging Face security incident of July 2026, which we covered last week.
In the account the alliance draws on, closed AI tools proved useless at the decisive moment of the response: unable to tell attackers from defenders, they blocked forensic analysis exactly when it was needed. Hugging Face was able to reconstruct the attack and contain it using an open-weight model, GLM 5.2, to analyse more than 17,000 actions.
The argument carries because it is specific. A proprietary model’s safety filter has no way of knowing whether the person asking it to analyse an exploit is writing it or suffering it: it refuses in both cases. For anyone doing incident response that refusal lands in the worst hour, and there is no appeal.
What they are putting on the table
The technical contributions named in the announcement are, for the most part, projects that already existed and are now moving under a shared umbrella:
- NOOA (NVIDIA Labs Object-Oriented Agent), an open source framework on GitHub for making agents testable and traceable.
- Safetensors from Hugging Face, the format for storing model weights without the arbitrary code execution risk that affects pickle-based formats.
- SPIFFE/SPIRE, the zero-trust identity standards, contributed by HPE.
- Lightwell, an IBM and Red Hat project extending security into the open source supply chain.
- MDASH, Microsoft’s multi-model scanning system.
- Grok Build, SpaceXAI’s open source coding agent.
The stated direction is an “open defence stack for agents” built on three axes: identity, isolation and secure model formats. Anyone who followed the recent story will recognise the three problems: they are exactly the ones the Hugging Face incident surfaced.
The precedents
An industry consortium on AI security is not a 2026 invention. The precedents are worth lining up, because the comparison says more than the announcement.
Coalition for Secure AI (CoSAI), July 2024, hosted by OASIS Open. Founding sponsors: Google, IBM, Intel, Microsoft, NVIDIA, PayPal, Amazon, Anthropic, Cisco, Chainguard, Cohere, GenLab, OpenAI and Wiz. Three workstreams: supply chain security for AI systems, preparing defenders, AI security governance. CoSAI states that it collaborates with the Frontier Model Forum, Partnership on AI, OpenSSF and MLCommons.
Akrites, 25 June 2026, hosted by the Linux Foundation. It grows out of a finding we covered with the kernel’s own numbers: AI models now find vulnerabilities in minutes rather than weeks, and the maintainers’ triage queue cannot keep that pace. The Akrites answer is organisational more than technological: a shared SIRT giving maintainers one predictable counterpart instead of a flood of uncoordinated reports, and the role of maintainer of last resort for critical packages left with nobody. Founding commitments from AWS, Anthropic, Chainguard, Cisco, Citi, Endor Labs, Ericsson, Google, IBM and GitHub, JPMorganChase, Microsoft, NVIDIA, OpenAI, RapidFort, Red Hat, the Rust Foundation, Sonatype, Vodafone and Zscaler.
Overlaying the three lists brings out two facts.
First: NVIDIA is in all three. That is consistent, and it is also the point at which to recall that NVIDIA sells the chips AI runs on, so it has a direct and legitimate economic interest in AI spreading as widely as possible, open and everywhere. It is the same observation we made three days ago about the “Open Weights and American AI Leadership” letter, likewise hosted by NVIDIA. Two pushes on open weights in four days, one on policy and one on security, out of the same orbit.
The second fact is more striking: Google, OpenAI and Anthropic are not in the Open Secure AI Alliance. All three sit in CoSAI, all three made commitments to Akrites, two of the three signed the open weights letter last week. They are absent precisely from the alliance that puts open-weight models at the centre of defence, and that opens with a case in which closed tools blocked defenders. None of the three has commented on the absence, and we do not know whether it is a choice, an exclusion or simply a matter of timing: we record the fact without assigning it a motive.
What the announcement is missing
As of 27 July, the announcement did not come with: the governance structure in detail, a joint roadmap, a first multi-member deliverable, or the models, weights and datasets NVIDIA says it intends to make available. There are no names and roles for whoever leads the alliance, and no calendar.
None of this disqualifies the initiative, which starts with serious names and a serious foundation on governance. It does frame what is being looked at: a statement of intent, not a release. The difference between the two is measured six months out, on the first artefact that ships with more than one signature on it.
What we think
This has to be said up front, or the enthusiasm reads badly: this alliance argues exactly the case we have been making for years, and that we put in our own positioning before it became consortium material. Open Intelligence, Secure Governance says two things: that the intelligence your work rests on should be owned and inspectable, and that owning it is not enough without a control plane that records and filters what it does. When a thirty-seven-organisation coalition presents those same two things as a programme, our judgement is not neutral and it would be dishonest to pretend otherwise.
That said, the Hugging Face argument deserves attention even from people who disagree with us, because it is the first public, documented case in which a model’s closedness harmed a defender in a real incident. Until yesterday the open weights debate turned on the risk of misuse, which is real and which NVIDIA itself acknowledges in the announcement. Now the opposite cost is on the table too, and it has a date.
For anyone running systems, the operational lesson is independent of the alliance and applies today. Your incident response plan should name the tool you will use when the usual one refuses to answer. An open-weight model running inside your perimeter is not only a sovereignty or a cost choice: it is the fallback for a capability you might discover you lack at the worst possible moment. It is the same reason we treat the closed frontier as technology someone else can filter or switch off, as in the Fable 5 case.
The other half is still control. A defence agent that inspects logs, runs commands and touches production systems is the use case where audit trail and policy matter most, not least: that is what Admina does on any model, local or remote, and it is the point of the OISG paradigm. Add the dull part no consortium solves for you: between the CRA and SBOM the same questions about provenance and inventory arrive from the regulator, with dates already set.
The right consortium on the right topic, with a real case behind it. We will come back to it when the first artefact ships: that is the moment you find out whether the table produces code or press releases.
Sources
- NVIDIA: Industry Leaders Join Open Secure AI Alliance for AI Safety and Security
- Linux Foundation: Open Models and Open Weights Are Foundational to Secure AI
- Help Net Security: Tech giants form alliance to put open AI in cyber defenders’ hands
- The Hacker News: NVIDIA Forms 37-Member Open Secure AI Alliance and Open-Sources NOOA Framework
- OASIS Open: Introducing the Coalition for Secure AI (CoSAI)
- Linux Foundation: Akrites launch