Linux Foundation seeks AI security incident sharing rules

The Linux Foundation has issued a Request for Comments on Shared AI Findings Exchange guidelines for agentic AI cybersecurity. The proposal is being developed with members of the Open Secure AI Alliance, which now includes more than 120 organisations.

The draft SAFE framework is intended to help organisations share information on AI security incidents and near misses in a structured way. The guidelines propose confidential collection and analysis of incidents, notification of affected parties, identification of recurring control failures, and publication of recommendations to reduce broader risk.

NVIDIA, Cisco, CrowdStrike, Hugging Face, and Red Hat are among the alliance members contributing to the initial proposal. The effort reflects growing concern that AI agents, which can act across software tools and corporate systems, create security weaknesses that go beyond traditional model testing.

Agentic AI systems typically combine models with identity controls, runtime restrictions, logging, evaluation, and external tools. Securing them requires oversight across several layers, including who can authorise actions, what the agent can access, how it behaves in production, and how incidents are recorded and reviewed.

Open tools

Alongside the SAFE proposal, alliance members outlined a broad set of open-source projects and model releases aimed at building a shared security stack for AI systems. NVIDIA highlighted tools including its NOOA research harness for testing and tracing agent behaviour, the OpenShell runtime for restricting agent access, and Garak, a scanner used to test large language models for issues such as prompt injection, jailbreaks, and data leaks.

The chipmaker also pointed to NeMo Guardrails, NeMo Anonymizer, and NeMo Safe Synthesizer, as well as several model families released with open weights, datasets, and training methods. Its verified agent skills are catalogued, scanned for risks including prompt injection and tool poisoning, cryptographically signed, and documented so users can track provenance and changes after publication.

Other alliance members are focused on different parts of the stack. Okta is working on reference implementations for agent identity and access based on the Cross App Access protocol, while Palo Alto Networks has contributed Agent Guard and Agent Watch tools from its Idira platform. Red Hat has established the asago open-source project to map governance requirements to runtime controls through a single audit trail.

New members

Amazon and Visa were identified as new alliance members. Amazon is contributing Strands Agents, an open-source toolkit for building AI agents, and Cedar, an open-source authorisation language intended to set verifiable limits on what agents are allowed to do.

Visa has contributed its Visa Vulnerability Agentic Harness, designed to help teams identify, remediate, and validate security issues. Capital One has open-sourced VulnHunter for code security, and Cloudflare is offering its Vulnerability Discovery Harness as an open-source skill for agent systems.

Microsoft AI Red Team has released several tools, including PyRIT for automated red teaming, RAMPART for turning findings and incidents into repeatable tests, Clarity for identifying design risks before code is written, and Assert for converting natural language safety requirements into executable evaluations. Wiz has also contributed Atlas, an autonomous vulnerability research engine that uses specialised AI agents to find and validate flaws in code and open-source packages.

Specialised models

Several members are also releasing models tailored to security tasks. Cisco has contributed DefenceClaw, a governance layer that sits on top of NVIDIA OpenShell, along with two Antares small language models for vulnerability localisation and Project CodeGuard for AI coding workflows.

CrowdStrike is fine-tuning the NVIDIA Nemotron Nano model for cyber defence. Internal testing showed 96% accuracy in generating investigation queries within Falcon LogScale, and the company has also published research on using a specialised reasoning model for Security Operations Centre detection triage with confidence scoring for autonomous decisions.

Mistral has released its Shieldstral multimodal safety classifier model as open weights under Apache 2.0. Akamai, Cognition, Perplexity, and Uber are contributing research and software intended to improve visibility into agent behaviour, threat analysis, and trustworthiness evaluation.

Uber said components of its Agentic AI Detection and Response system have been open-sourced. According to the alliance, the system reconstructs the chain of agent activity from prompt to reasoning, tool calls, and outcomes, and currently supports more than 200,000 agent sessions per day across 30,000 endpoints.

Resilience focus

The alliance also highlighted resilience and recovery as a separate area of work. LangChain is adding functions to its open-source frameworks so agents can retry interrupted tasks, resume from saved state, and fall back to alternative models when a primary model fails.

Veeam is contributing technologies including Kanister, an open-source framework for Kubernetes data protection. It is intended to help organisations recover AI workloads, vector databases, and associated data to a verified known-good state after disruption.

The SAFE proposal suggests the alliance wants to move beyond publishing tools and towards common operating practice for incident handling. If adopted, it would give organisations a way to share lessons from AI security failures without exposing sensitive details, while creating a shared body of evidence on which defences are proving weak across the sector.

The Linux Foundation shared the Request for Comments as work on the SAFE draft continues among Open Secure AI Alliance members.