A week after the Open Secure AI Alliance (OSAA) was formed, the group has shown its first concrete tools for securing AI systems. The initiative, led by Nvidia, already brings together more than 120 companies and operates under the Linux Foundation. That pace is notable for an organization that only just launched.
Key takeaways
- OSAA brings together more than 120 companies, with Nvidia as the driving force.
- The Shared AI Findings Exchange (SAFE) working group is managed by the Linux Foundation.
- Nvidia contributed Garak, an open-source vulnerability scanner for language models.
- Amazon added the Strands Agents tool and the Cedar authorization language.
- Anthropic, Google and OpenAI are not members of the alliance.
An alliance of 120-plus companies
The alliance, driven by Nvidia, took shape after more than 200 tech companies signed an open letter urging the White House to support open-source AI. OSAA formalizes that cooperation around a single goal: jointly finding and fixing flaws in AI systems.
At its core is the Shared AI Findings Exchange (SAFE) working group, managed by the Linux Foundation — the same body that oversees the Linux kernel and dozens of infrastructure projects. That detail matters, because it means neutral, vendor-independent stewardship of security research findings.
What has already been delivered
Rather than stop at declarations, members handed over working tools right away. Nvidia released Garak, an open scanner that tests language models for vulnerabilities such as prompt injection?prompt injection: An attack that crafts an input so the model ignores its own instructions and does what the attacker intends. and jailbreaks. Amazon added Strands Agents, a tool for building agents, and Cedar, a language for defining authorization rules. Okta contributed identity technology for AI agents, and Red Hat brought agent governance mechanisms.
| Company | Contribution to OSAA |
|---|---|
| Nvidia | Garak — language-model vulnerability scanner |
| Amazon | Strands Agents and the Cedar language |
| Okta | identity technology for AI agents |
| Red Hat | agent governance mechanisms |
The alliance also includes Intel, Microsoft, Adobe, Cisco, Visa, BlackRock and Hugging Face. The common thread is clear: securing AI agents, meaning systems that carry out tasks on their own and require authentication and permission control.
Who is in, and who is missing
The membership list is broad, but its gap stands out. Three labs building the most powerful models are absent from OSAA: Anthropic, Google and OpenAI. That is significant, because the alliance bets on openness as a path to safety, while those companies rest their edge on closed models. The group's letter contained a line that captures its philosophy.
Openness may be one of the most important paths to AI safety and security.
From the Open Secure AI Alliance letter.
Why it matters
AI safety usually plays out inside closed labs, and test results are rarely shared between companies. OSAA tries to invert that pattern: to make flaw-finding a common good, modeled on open source in software. Delivering working tools rather than mere announcements sets this effort apart from typical industry pledges. The absence of Anthropic, Google and OpenAI shows, however, that the open-versus-closed divide runs through the approach to safety itself, not just through the models.
What's next
- The SAFE group under the Linux Foundation is meant to coordinate the exchange of vulnerability information — further member contributions are announced on Nvidia's blog.
- It remains open whether Anthropic, Google or OpenAI will join, given that their models are the most frequent target of attacks today.
- The development of tools like Garak will decide whether OSAA becomes a real testing standard or stays a collection of separate projects.
Sources
- TechCrunch — Nvidia doesn't mess around: A week after open AI industry group formed, it's already showing progress
- Linux Foundation — Proposing the SAFE Working Group
- NVIDIA Blog — Open Secure AI Alliance contributions
