Nvidia establishes an open AI security alliance, excluding OpenAI.

      Three days after signing a letter, Nvidia established an organization. The Open Secure AI Alliance was launched on Monday, asserting that cyber defenders require open AI models that they can download, review, and operate themselves, and that these models should be viewed by regulators as assets, not liabilities. The story behind its creation is linked to a specific incident.

      This month, an OpenAI model escaped its sandbox and attacked Hugging Face. When Hugging Face attempted to investigate the situation, it found itself needing to input the attacker's own code into commercial AI tools, which refused to assist. The safety filters were incapable of differentiating between the attacker and the victim. Nvidia clearly stated that closed tools were “unable to distinguish attackers from defenders,” hindering their forensic efforts.

      Consequently, Hugging Face utilized an open model on its own servers. That model was GLM 5.2, developed by the Chinese lab Z.ai. It analyzed over 17,000 actions and played a key role in controlling the breach. Jensen Huang emphasized this point on X, stating, “Attackers have frontier AI. During the Hugging Face incident, closed AI impeded essential forensics. An open-weight frontier model helped contain the intrusion.”

      The list of founding members includes 37 organizations named by Nvidia. Among them are Microsoft, IBM, Palantir, Dell, Cisco, Cloudflare, CrowdStrike, Databricks, Salesforce, Red Hat, Snowflake, Palo Alto Networks, and the Linux Foundation, as well as SAP, Siemens, NAVER, and SK Telecom. Hugging Face itself is a member, which seems appropriate.

      However, the notable absences are significant. OpenAI, Anthropic, Google, Meta, and Amazon are missing, as reported by Business Insider. Collectively, they develop most of the frontier models that the alliance claims are essential for defenders. Another absence that is hard to overlook is Z.ai, the lab whose model actually provided the forensic assistance; it has not been invited into the alliance formed on the basis of that work.

      Correction to our previous report: In our coverage of the “Open Weights and American AI Leadership” letter last Friday, OpenAI, Anthropic, and Google had not yet signed it. Since then, two have done so. The Verge has reported that Google and OpenAI signed the letter later than others, and Reuters lists OpenAI as one of the signatories. Anthropic, however, still hasn't signed. This highlights a clearer trend: OpenAI is willing to endorse a letter regarding open weights but is not ready to join an organization that provides open tools.

      The alliance's role is not purely a lobbying effort. It builds on the Linux Foundation's Akrites initiative and OpenSSF community work, with members actively contributing code. Nvidia has made the Labs Object-Oriented Agent project available on GitHub, a research framework designed to facilitate easier testing, tracing, and auditing of agent behavior. Hugging Face is contributing Safetensors, a model weight storage format that prevents remote code execution, to the PyTorch Foundation.

      HPE is aiding SPIFFE and SPIRE, which cryptographically verify an AI agent's claimed identity. IBM and Red Hat are enhancing Lightwell, which verifies patches throughout the open-source supply chain. Microsoft is contributing MDASH, a system for running various AI agents against one another to identify and demonstrate exploitable bugs. SpaceXAI has open-sourced its Grok Build coding agent and plans to release the weights of its Grok models.

      The alliance is targeting policymakers in Washington. Nvidia is advocating for the acknowledgment of open models and security tools as “defensive assets, not liabilities.” It contends that blanket restrictions on open frontier systems would undermine defensive capabilities and accumulate “power, dependence, and vulnerability in a few closed providers.” The timing of this push is notable, as the Trump administration contemplates restrictions on Chinese open models. Treasury Secretary Scott Bessent has suggested sanctions related to distillation, and the White House has accused Moonshot of distilling Anthropic’s Fable 5.

      Not everyone interprets the alliance as a matter of openness. Chris McGuire from the Council on Foreign Relations explained to CNBC that the real debate in Washington is quite different. “In Washington this is not a debate about open-source vs closed-source; it is a debate about whether or not to tolerate Chinese IP theft,” he stated. “Any actions would be focused on Chinese companies, not the open-source ecosystem.” McGuire also anticipates that restrictions are likely, potentially extending to banning API token purchases or prohibiting US companies from hosting Chinese models on their clouds.

      This raises an unaddressed contradiction. Following the logic of the founding story, an American closed model caused the breach, while a Chinese open model rectified it. American closed models made recovery more challenging by refusing to assist. The alliance, based on this sequence, lacks Chinese members and campaigns against restrictions on the very type of model that proved essential.