NVIDIA and more than 35 founding partners have launched the Open Secure AI Alliance, an initiative focused on developing open-source tools, models, agent frameworks, and security technologies for AI systems. The alliance represents a significant shift in how the industry thinks about securing AI agents, arguing that security should be evaluated across the entire agent stack rather than relying solely on closed, proprietary models.

The membership tells an important story about where the industry stands on AI security. While Microsoft, IBM, Cisco, Palantir, Dell Technologies, and HPE are founding members, three major players are notably absent: OpenAI, Google, and Anthropic, the companies most closely associated with frontier closed-source AI models. This absence underscores a fundamental disagreement about whether keeping models proprietary is the best path to security.

What Does an AI Agent Security Stack Actually Include?

The alliance argues that an AI agent is far more than just a language model. It includes the orchestration layer that coordinates the agent's actions, the tools it can access, identity controls that verify who or what is making requests, permissions that limit what each agent can do, isolation mechanisms that prevent one agent from interfering with another, guardrails that catch dangerous behavior, logging systems that record what happened, and evaluation processes that measure whether the agent is behaving safely.

This full-stack perspective matters because a vulnerability at any layer can compromise the entire system. A prompt injection attack hidden in a GitHub issue, a hallucinated destructive command, or a compromised tool could expose secrets or cause damage, even if the underlying model is secure. The challenge is that no single tool solves all these problems.

How to Secure AI Coding Agents Across Multiple Threat Vectors?

• Destructive Command Prevention: Protect against dangerous shell commands like recursive deletions or disk-wiping operations that could destroy systems or data.
• Secret Exfiltration Defense: Prevent agents from reading and sending sensitive credentials like API keys, SSH keys, or database passwords to external endpoints.
• Prompt Injection Blocking: Stop malicious instructions embedded in files, GitHub issues, or tool responses from overriding the agent's original intent.
• Supply Chain Attack Detection: Catch when agent skills or tools have been swapped for malicious versions after initial approval.
• MCP Tool Abuse Prevention: Gate calls to Model Context Protocol (MCP) servers and validate their responses before the agent acts on them.
• Reverse Shell Protection: Block command-and-control callbacks that could give attackers remote access to systems.

Different tools address different threats. Belay, an open-source security layer launched on July 27, 2026, sits at the agent's tool-call boundary and gates every command, file read, and MCP call in under 100 milliseconds without requiring a language model to make the decision. It includes native hooks for 11 different agents, including Claude Code, Cursor, Hermes, and OpenClaw, plus an MCP proxy for wrapping any MCP server.

Claude Code, Anthropic's coding agent, offers built-in guardrails that do not require external tools. These include subagent tool allowlists and denylists that restrict which operations specific agent profiles can perform, hook lifecycle events that validate commands before execution, and CLAUDE.md policy files that define project-level permissions. However, these guards only work within the Claude Code runtime and rely on the agent respecting the constraints.

Codex CLI, OpenAI's approach, runs generated code inside a Docker container by default, providing a hardware-level boundary between the agent and the host system. This is highly effective against destructive commands and reverse shells because the container has limited filesystem and network access. The tradeoff is granularity: Docker is an all-or-nothing boundary, making it less suitable for workflows where agents need selective access to specific files or environment variables.

Why Is the Alliance Pushing Back Against Closed-Model-Only Security?

The Open Secure AI Alliance contends that closed models do not eliminate misuse risks and can actually limit defenders' ability to inspect behavior, validate controls, or operate AI capabilities within their own infrastructure. Open models can create risks if safeguards are removed or if the model is adapted for offensive purposes, but the alliance argues that closed models face similar vulnerabilities while offering less transparency.

This perspective is particularly relevant in regulated sectors and sovereign environments where organizations need direct operational control over sensitive data, model behavior, security logs, and incident-response workflows. A bank, for example, might need to run AI agents on its own servers without sending data to a third-party provider, which requires access to model weights and the ability to inspect and modify the agent's behavior.

The alliance is calling for shared investment in open datasets, evaluation frameworks, attack simulators, red-teaming tools, secure model distribution, and agent security controls. NVIDIA plans to contribute open models, model weights, data, and research on agent harnesses, including the NVIDIA Labs Object-Oriented Agent (NOOA) project, a research framework designed to improve the safety and auditability of AI agent harnesses by making it easier to test, trace, govern, and evaluate agent behavior.

Founding members are already contributing specific technologies. HPE is supporting SPIFFE/SPIRE, an open framework for zero-trust workload identity that uses cryptographic verification to authenticate services and AI agents. Hugging Face contributed Safetensors, a model-weight format designed to avoid arbitrary code execution risks associated with some serialized model-file formats. IBM and Red Hat highlighted Lightwell, which uses digitally signed patches to improve integrity across the open-source software supply chain. Microsoft contributed MDASH, a multi-model agentic scanning harness that coordinates specialized AI agents to identify and assess potentially exploitable software vulnerabilities. SpaceXAI open-sourced Grok Build, a terminal-based AI coding agent, and signaled intent to release model weights for Grok models.

The alliance is also advocating for policy approaches that treat open AI tools as part of cybersecurity infrastructure rather than categorically as a risk factor. Its position is that broad restrictions on frontier open models could increase reliance on a limited number of proprietary providers while reducing the ability of enterprise and government defenders to test and harden their own systems. For enterprise infrastructure teams, this effort underscores the growing need to secure AI deployments as interconnected systems that combine models, applications, identities, storage, networking, observability, and automated decision-making.