Cognition, the company behind the Devin AI coding agent, has joined a major new coalition of tech giants and security firms pushing back against restrictions on open-source artificial intelligence models. On July 27, Nvidia, Microsoft, IBM, and more than 30 other companies launched the Open Secure AI Alliance, a group dedicated to building open-source cybersecurity tools for AI agents. The alliance frames open-source AI as a defensive necessity rather than a security risk, arguing that closed systems leave security teams unable to inspect or adapt the models protecting critical infrastructure.

What Is the Open Secure AI Alliance and Why Does It Matter?

The Open Secure AI Alliance represents a significant shift in how the AI industry is approaching security. The coalition includes infrastructure providers like Nvidia and Microsoft, security vendors such as Cisco and CrowdStrike, enterprise software companies like Salesforce and SAP, and open-source foundations including the Linux Foundation. Cognition's inclusion signals that coding AI agents are now central to the broader conversation about AI security and governance.

The alliance's core argument is straightforward: when security teams cannot run advanced AI models on their own hardware or inspect how those models work, their ability to respond to attacks is severely limited. This became clear during a recent security breach at Hugging Face, a major open-source AI platform. According to the alliance's announcement, closed AI systems refused to run the forensic analysis needed to investigate the breach because they could not distinguish attackers from defenders. Hugging Face instead turned to an open-weight model called GLM 5.2, ran it on its own infrastructure, and processed more than 17,000 actions to contain the intrusion.

"When closed AI tools, unable to distinguish attackers from defenders, blocked essential forensic analysis, Hugging Face ran the open-weight GLM 5.2 model on its own infrastructure to analyze more than 17,000 actions and contain the intrusion," the alliance stated in its announcement.

Open Secure AI Alliance, Nvidia announcement

How Are Alliance Members Contributing to AI Security?

• Nvidia's Contribution: The company is open-sourcing the NVIDIA Labs Object-Oriented Agent framework, or NOOA, on GitHub to make agent behavior easier to test, trace, and audit for potential vulnerabilities.
• Microsoft's Contribution: The tech giant is contributing MDASH, a multi-model agentic scanning harness that orchestrates specialized AI agents to find exploitable bugs in systems.
• IBM and Red Hat's Contribution: These companies are extending their Lightwell project to enable signed patches across the open-source supply chain, improving security updates.
• HPE's Contribution: The company is contributing to SPIFFE/SPIRE, a zero-trust identity framework for verifying that AI agents are who they claim to be.
• Hugging Face's Contribution: The platform has donated its Safetensors format to the PyTorch Foundation, making it easier to safely share AI model weights.

The scope of technical contributions is unusually broad for a launch-day coalition. Most industry alliances typically open with a manifesto and fill in the code later, but the Open Secure AI Alliance is shipping working tools from day one.

Why Is Cognition's Devin AI Part of This Debate?

Cognition's Devin is an AI coding agent designed to autonomously write, test, and deploy software. As AI agents become more capable and more widely deployed in critical systems, questions about their security and transparency have become urgent. By joining the Open Secure AI Alliance, Cognition is signaling that it believes open-source security tools and frameworks are essential for building trustworthy AI agents.

The alliance is also making a direct pitch to policymakers. Members argue that governments should treat open models, harnesses, and security tools as defensive assets rather than liabilities. They are asking for investment in shared open infrastructure, including datasets, evaluation frameworks, attack simulators, and red-teaming tools, similar to how past generations of policy funded open-source software.

This stance puts the alliance in direct opposition to a rival letter signed earlier by OpenAI and Anthropic, which urged Washington to curb Chinese open-weight models. The Open Secure AI Alliance argues the opposite: that blanket restrictions on open frontier systems would concentrate power in a small number of closed providers and weaken cyber defense across the broader ecosystem.

What Does This Mean for Developers and Enterprises?

The alliance's framing reflects a competitive fault line in the AI industry. On one side sit the closed frontier labs pushing for tighter export and access controls. On the other sits an increasingly organized bloc spanning infrastructure providers, cybersecurity vendors, and open-source foundations that sees regulatory capture as the bigger risk. With Nvidia, Microsoft, and IBM on the open side, that bloc now has the enterprise weight to be heard in Washington and Brussels.

For developers and enterprises using AI agents like Devin, the outcome of this policy debate will shape what tools are available and how transparent those tools can be. If the alliance succeeds in its regulatory pitch, developers will have greater access to open-source security frameworks and the ability to audit AI agents running on their systems. If closed-model advocates prevail, security teams may face the same constraints that Hugging Face encountered during its breach: unable to run forensic analysis because the AI system cannot distinguish defenders from attackers.

The alliance also reflects a broader recognition that AI safety and security depend on the full stack of tools and practices, not just on whether model weights are open or closed. This includes identity verification, permissions management, guardrails, logging, and evaluation frameworks working together as an integrated system.