Open Secure AI Alliance launches with 35+ companies including Adobe, Microsoft, Salesforce

Industry leaders have launched the Open Secure AI Alliance under the Linux Foundation, uniting 35+ companies—including NVIDIA, Microsoft, Adobe, Salesforce, CrowdStrike, Palantir, Databricks, and Hugging Face—to develop and share open technologies, tools and techniques for safeguarding software and AI agents. The move was catalyzed by the recent Hugging Face security incident, where closed AI tools failed to distinguish attackers from defenders, forcing Hugging Face to deploy the open-weight GLM 5.2 model on its own infrastructure to contain the intrusion and analyze over 17,000 anomalous actions.

The Alliance argues that both closed and open frontier AI models are necessary for cybersecurity. While closed models can be misused, so can open ones—but open systems enable distributed, multi-vendor defense without single points of failure and allow defenders to audit, adapt and run AI on their own infrastructure at critical moments. The real safety mechanism lies not in closed weights alone, but in the full agent stack: identity frameworks, harnesses, guardrails, logs and evaluation. HPE contributes zero-trust standards via SPIFFE/SPIRE; IBM/Red Hat offer Lightwell (supply-chain security); Microsoft contributes MDASH (multi-model scanning harness); and NVIDIA open-sourced NOOA (object-oriented agent research for harness design).

For teams shipping agents in production: this is infrastructure-grade. The Hugging Face case study shows that sovereign control over AI defenses matters operationally—when forensic speed is critical and detectors fail, defenders need their own frontier models. The alliance recognizes that cloud-locked security is a vulnerability. Also notable: 35 companies (including competitors like CrowdStrike and Palo Alto Networks) coordinating on open defense standards signals that AI security governance is becoming table-stakes, not a differentiator.