A coalition of more than 120 organizations, including NVIDIA, Cisco, CrowdStrike, Hugging Face, and Red Hat, is developing new guidelines to turn AI security incidents into shared protection for the entire industry. The Linux Foundation announced the Shared AI Findings Exchange (SAFE) framework at the Black Hat conference, proposing a structured approach to confidentially collect, analyze, and learn from agentic AI security breaches before they spread across the ecosystem.

Why Does Agentic AI Need Its Own Security Framework?

Agentic AI systems are fundamentally different from traditional software. An AI agent isn't just a language model; it's a complete system that includes identity controls, security harnesses, guardrails, logs, and evaluation tools. When an agent can call external tools, access databases, and make autonomous decisions, the attack surface expands dramatically. The SAFE guidelines address this reality by proposing that defenders move "at agent speed" to respond rapidly and protect infrastructure and intellectual property.

The OWASP Top 10 for LLM Applications, updated in November 2024, highlights why this matters in practice. Prompt injection, where attacker text makes a model ignore its real instructions, has held the top security risk position since the framework's 2023 origin. But agentic systems face additional risks that traditional application security frameworks never anticipated. A separate OWASP Top 10 for Agentic Applications, published in December 2025, now addresses risks specific to autonomous, tool-using agents, such as goal hijacking and cascading agent failures.

What Does the SAFE Framework Actually Propose?

The SAFE guidelines include four core components designed to strengthen collective defense. Organizations would confidentially collect and analyze AI incidents and near misses, inform those impacted by security events, identify recurring control failures across the ecosystem, and publish evidence-based operating recommendations that reduce systemic risk.

This approach mirrors how the cybersecurity community has handled vulnerability disclosure for decades, but adapted for the speed and complexity of AI systems. When trusted ecosystems share threat intelligence openly, collective defense becomes what security experts call a "force multiplier." The hardest problems get solved when defenders learn from each other openly and at speed.

How to Build Layered Security Into Agentic AI Systems

• Identity and Access Controls: Okta is developing reference implementations for agent identity and access using Cross App Access (XAA), an open protocol that enables AI agents to securely connect to enterprise applications. Red Hat's asago project maps an organization's governance requirements directly to what agents are allowed to do at runtime, creating a single audit trail from policy to live control.
• Harnesses and Runtime Guardrails: Amazon's Strands Agents toolkit provides full visibility into agent behavior and evaluation in production. Microsoft's PyRIT (Python Risk Identification Toolkit) enables automated red teaming with built-in memory and support for custom endpoints. NVIDIA's OpenShell runtime restricts what an agent can see, touch, and do, enforcing security and privacy controls at the agent level.
• Specialized Security Models and Scanning: Cisco's DefenseClaw provides an agentic governance layer on top of NVIDIA OpenShell for automated security at runtime. NVIDIA's Garak, an open-source LLM vulnerability scanner, lets security teams check models for data leaks, prompt injections, and jailbreak scenarios before deployment. Cisco also released two Antares security small language models to pinpoint known vulnerabilities in codebases.
• Output Validation and Least Privilege: The OWASP Top 10 for LLM Applications emphasizes that model output must be validated before use, with schema validation and sandboxing to prevent injection attacks downstream. Excessive agency, where systems grant models too much autonomy or permission, requires per-tool authorization and human approval for risky actions.

What Real-World Risks Are Driving This Effort?

The OWASP Top 10 for LLM Applications exists because prompt injection, data leakage through retrieval-augmented generation (RAG) pipelines, and over-permissioned AI agents are not hypothetical problems. They are documented ways real LLM applications get attacked in production today. Real attacks chain multiple risks together, so layered, defense-in-depth controls matter more than any single fix.

Agentic systems amplify these risks because one bad decision can cascade across multiple tool calls and autonomous actions without human review. An agent with excessive permissions might execute unauthorized transactions or destructive actions. An agent with access to sensitive data pipelines might leak proprietary information. An agent with poor input validation might fall victim to prompt injection and execute unintended commands.

The SAFE framework recognizes that cybersecurity is "a race without a finish line." Every major technology shift creates new attack surfaces. The Open Secure AI Alliance's approach is to ensure that defenders learn from each other's incidents, not in isolation.

Who Is Contributing to the Open Secure AI Alliance?

The coalition has grown to include more than 120 organizations. Recent additions include Amazon and Visa, which joined to contribute their own security tools and harnesses. Amazon contributed Cedar, an open-source authorization language that enforces deterministic, verifiable boundaries on what AI agents are permitted to do. Visa contributed its Vulnerability Agentic Harness to help teams identify issues, support remediation, and validate fixes quickly and safely.

Other contributors span the full defensive stack. Capital One open-sourced VulnHunter for agentic AI code security. Cloudflare is offering its Vulnerability Discovery Harness as an open-source skill to add security to agent systems. Microsoft AI Red Team has open-sourced several tools, including RAMPART, which turns red-team findings into repeatable tests that run as software changes, and Clarity, which helps teams question design assumptions before code is written.

NVIDIA's contributions run the length of the security stack, starting with the NVIDIA Labs Object-Oriented Agent (NOOA) research harness, which makes agent behavior easier to test, trace, audit, and govern. NVIDIA also released NeMo Guardrails, NeMo Anonymizer, and NeMo Safe Synthesizer to enforce safety policies, protect sensitive data, and generate privacy-safe synthetic data.

What Does This Mean for Teams Building AI Agents?

The SAFE framework and expanded security guidance signal that agentic AI is moving from experimental to production-critical infrastructure. Teams building autonomous agents should read both the OWASP Top 10 for LLM Applications and the newer OWASP Top 10 for Agentic Applications together. The lists work best alongside NIST AI RMF, MITRE ATLAS, and existing OWASP frameworks like ASVS and API Security Top 10.

The key insight is that securing an AI agent requires more than vulnerability scanning or model safety testing. It requires securing the entire system: identity controls, harnesses, guardrails, logs, and evaluation. When defenders share what they learn from incidents, the entire ecosystem moves faster and stronger.