NVIDIA and 36 other companies, including Microsoft, Cisco, and Hugging Face, have launched the Open Secure AI Alliance to share open technologies for securing software and AI agents. The group's first contribution is NOOA (NVIDIA-labs OO Agents), an Apache 2.0 research framework for testing and tracing agent behavior.

NOOA represents an agent harness as a Python class with docstrings as prompts and type annotations as contracts. NVIDIA reports an 86.8% score on the CyberGym vulnerability benchmark. But the repository carries a sharp warning: NOOA can execute LLM-generated Python that may delete files or exfiltrate data. Its built-in checks are 'not a containment boundary'; operators must use OS-level isolation like containers.

The alliance's pitch is that defenders need modifiable, locally runnable models, not just APIs. NVIDIA tied this to July's Hugging Face intrusion, where an autonomous agent compromised internal systems. Hugging Face used open-weight GLM 5.2 on its own infrastructure to reconstruct the attack timeline, bypassing commercial APIs that blocked its analysis tools. The company advised having a capable local model ready before incidents.

While the alliance has 37 member organizations, its public materials lack a charter, governing board, or roadmap. The Linux Foundation called itself an inaugural partner but didn't say it hosts the project. Member commitments range from contributing research (Elastic, CrowdStrike) to providing neutral ground. For now, the only joint code is NOOA, maintained by NVIDIA. The alliance's future deliverables remain undisclosed.

Source: The Hackers News