Menu
SUBSCRIBE
SUBSCRIBE
Menu

Linux Foundation

Digital globe above AI, cybersecurity and technology icons representing collaboration on the proposed SAFE guidelines.

Open Secure AI Alliance Proposes SAFE Guidelines for Cybersecurity Transparency

, , , , , , , , , ,

Backed by more than 120 leading AI, cybersecurity, and technology companies, the draft calls for confidential reviews of AI incidents, notices to affected organizations, and public recommendations based on repeated security failures.

 

The Open Secure AI Alliance proposed SAFE guidelines for companies to share AI security incidents and near misses confidentially, warn affected organizations, and publish recommendations that could help prevent similar failures.

The Linux Foundation published the proposal under the name Shared AI Findings Exchange, or SAFE, and invited the public to provide input.

NVIDIA, Cisco, CrowdStrike, Hugging Face and Red Hat are among the alliance members developing the proposed guidelines.

SAFE looks to turn incidents into shared defenses

The proposed process would confidentially collect and examine reports of cyberattacks, other cybersecurity failures and near misses involving AI agents.

The proposal calls for organizations affected by an incident to be notified. Reported cases would also be examined to identify security controls that failed repeatedly and develop public recommendations based on the evidence.

The proposal would give participating companies a way to share useful security information without immediately making sensitive incident details public. Published recommendations could allow other organizations to strengthen their own controls before they experience the same type of failure.

NVIDIA did not disclose specific reporting deadlines or say when the guidelines could be finalized.

Members add tools for controlling and testing AI agents

The SAFE proposal is part of a larger collection of open security tools that alliance members are making available for companies to inspect and adapt.

NVIDIA contributed software that records how AI agents behave during tests and restricts their access and actions. It also contributed tools that help companies enforce safety rules, protect sensitive data, and test AI models for data leaks or attempts to bypass safeguards.

Other contributions focus on identity and access. Okta is developing a way for AI agents operating in restricted environments to connect securely to company applications. Palo Alto Networks contributed tools that help developers control agent identities and retrieve passwords or other digital credentials securely.

Red Hat contributed a project that turns company policies and outside requirements into restrictions on what AI agents can do. It also records each restriction and maps them back to the corresponding policy or requirement.

Amazon contributed tools that let developers inspect agent behavior and set precise limits on which agent actions can reach company systems.

Microsoft contributed software that converts security incidents and written safety requirements into repeatable tests. Companies can run those tests again after software changes to check whether earlier problems have returned.

Cisco and CrowdStrike contributed more specialized tools for cyber defense. Cisco’s projects help companies apply security controls while AI agents are operating and locate known software weaknesses. CrowdStrike is adapting an NVIDIA model to help security teams generate investigation searches and sort security alerts.

Alliance grows beyond its original membership

The update follows the formation of the Open Secure AI Alliance with more than 50 AI, cybersecurity, and enterprise technology organizations.

When launched in July, the alliance announced plans to develop shared tools for verifying AI agent identities, controlling access, examining behavior, and isolating agents when necessary. NVIDIA presented the group partly as a response to the Hugging Face security incident, which showed the need for defensive AI tools that companies can inspect, adapt, and run on their own systems.

The alliance now has more than 120 members. Amazon and Visa are among the newest members, and NVIDIA said more security contributions are coming.

Dark blue network of glowing lines and nodes for Appia Foundation AI trust standards coverage.

Industry Coalition, Appia, Launches Push To Standardize AI Trust Checks

, , , , , , , , , ,

The Appia Foundation launched under the Linux Foundation with 13 initial members, including OpenAI, Google, Microsoft, Arm, Mastercard, Schneider Electric, and Siemens.

 

The Linux Foundation launched the Appia Foundation, an industry-backed group created to help companies and governments verify whether AI systems meet trust, safety, and compliance requirements.

The foundation formed because AI is moving faster than the systems used to assess it. Companies are adopting AI at scale throughout their organizations, while regulators, customers, and business partners increasingly want proof that those systems can be trusted.

Appia’s answer is to create clear, common requirements that turn AI standards and legal obligations into specific criteria that can be tested and audited.

The foundation launched under the Linux Foundation’s Joint Development Foundation, which provides a legal and organizational framework for companies and institutions to work together on shared technology projects, including developing technical specifications, standards, data sets and source code. Appia said it will create open specifications that apply across the AI value chain.

There are 14 initial members including Google, Mastercard, Microsoft, Mitsubishi Electric, Nemko, OpenAI, and Siemens.

The Appia Foundation said the specifications will serve as the basis for testing criteria, evaluation guidelines, and component typologies (categories of AI system parts, such as algorithms and datasets) covered by the standards. The goal is to provide organizations with a more consistent way to assess AI systems without forcing every company to start from scratch.

Jim Zemlin, Chief Executive of the Linux Foundation, said global organizations need a consistent and practical way to verify that AI systems conform to new expectations as international standards and laws become more established.

Craig Shank, Executive Director of the Appia Foundation, said, “AI systems now make decisions about people’s loans, their children’s schools and their jobs. People on the receiving end deserve to know those systems were built and assessed against criteria that hold up to scrutiny.”

Major technology companies framed the effort as a way to reduce fragmentation in AI governance. Amanda Storey, Google’s Vice President of Trust and Safety, EMEA, said Google joined Appia to work with the industry on global AI safety standards. Natasha Crampton, Microsoft’s Chief Responsible AI Officer, said organizations need practical ways to demonstrate the trustworthiness of their AI systems as adoption accelerates.

OpenAI also backed the effort. Ann O’Leary, OpenAI’s vice president of global affairs, said global trust in advanced AI will require shared, practical standards, not just shared principles.

The foundation is now inviting additional organizations to join. Its work will test whether major AI developers, enterprise technology companies, and assurance providers can agree on a common way to measure AI trust before regulators and buyers impose their own.