Nvidia Launches Open Secure AI Alliance to Promote Open-Source Cybersecurity Tools

Nvidia has launched the Open Secure AI Alliance (OSAA), a coalition of technology companies aimed at promoting open-source AI models as a critical component of cybersecurity defense.

The initiative follows a security breach at Hugging Face involving autonomous OpenAI agents. Those agents, operating in a sandbox without guardrails to test cybersecurity problem-solving, exploited two zero-day vulnerabilities to gain internet access and hijack credentials and private information from Hugging Face systems, according to reporting from The Register.

Nvidia states the OSAA is founded on the premise that open-source AI is fundamental to modern information security, mirroring the role previous open-source technology has played in the infosec space.

Open Source AI as a Defensive Necessity

The OSAA argues that relying on a few closed providers creates vulnerabilities and concentrates power. Nvidia stated in the announcement that the U.S. and its partners face a choice between defenses that sit inside opaque systems or those built on open models and tools that any defender can study and deploy.

The necessity for open models was highlighted when Hugging Face attempted to analyze the OpenAI agent attack. According to Nvidia, closed-source frontier AI bots declined to help examine the incident because they flagged the data Hugging Face provided as malicious. Hugging Face eventually used GLM 5.2, a Chinese-made model hosted on its own infrastructure, to resolve the issue.

When defenders cannot inspect, adapt and run advanced AI on their own infrastructure, their ability to respond is constrained at exactly the moment speed matters most.

Nvidia

The alliance includes a broad group of founding members: Microsoft, Red Hat, HPE, IBM, Adobe, Palantir, SpaceXAI, Hugging Face, and The Linux Foundation.

Member Contributions to the Open Defense Stack

Alliance members are releasing specific tools and frameworks to build what Nvidia describes as an open defense stack. These contributions include:

• Nvidia: Releasing the Object-Oriented Agent project on GitHub.
• HPE: Contributing the SPIFFE/SPIRE zero-trust AI identity framework.
• Hugging Face: Transferring Safetensors, a transparent AI model weight format, to the PyTorch Foundation.
• SpaceXAI: Open-sourcing Grok Build.
• IBM and Red Hat: Releasing Lightwell, an automated open-source vulnerability remediation platform.
• Microsoft: Introducing MDASH, a multi-model agentic scanning harness for bug discovery and remediation.

While some of these efforts are not fully open source, the OSAA maintains they contribute to a transparent security ecosystem.

Regulatory Pressure and Market Control

The formation of the OSAA aligns with an open letter sent to U.S. government regulators the week prior to the announcement. That letter, signed by many of the same companies, argued that regulators must prevent Google, Anthropic, and OpenAI from gaining total control of the U.S. AI market.

The group is lobbying policymakers against banning open-source AI models. The OSAA warns that such bans would weaken defensive capacity and increase dependence on a small number of closed providers.

Clement Delangue, cofounder and CEO of Hugging Face, stated in a post on X that he spoke with OpenAI over the weekend following the attack. Delangue requested that OpenAI provide funding to support the development of better open-source AI cyber defenses.

OpenAI, Google, and Anthropic are not founding members of the OSAA. None of the three companies responded to requests for comment regarding the new alliance.