Yesterday, NVIDIA announced the Open Secure AI Alliance, a 37-member industry coalition built specifically to develop open-source AI security tools. The members include Microsoft, IBM, Hugging Face, Cloudflare, CrowdStrike, Palantir, LangChain, Databricks, Red Hat, SpaceX's AI division, Cisco, ServiceNow, and about two dozen others.
Conspicuously absent from the list: OpenAI, Google, and Anthropic.
The invite list is the story.
Why the three biggest AI vendors aren't there
Nobody at NVIDIA has explicitly said why OpenAI, Google, and Anthropic weren't included. They don't have to. The reason was documented in public two weeks ago, when Hugging Face published the full post-mortem on their breach.
During a live AI security incident — autonomous AI agents executing 17,000+ actions, moving laterally, harvesting credentials — Hugging Face's security team tried to use a leading US frontier model to analyze the attack logs. The model refused. Safety guardrails blocked every request containing real attack commands, exploit payloads, or malware artifacts. The model couldn't distinguish a defender analyzing an attack from an attacker building one. It shut down.
The team switched to GLM 5.2, an open-weight model from Z.ai, ran it on their own infrastructure with no guardrails in the way, and processed all 17,000 logs locally. That's what actually contained the breach.
When the most sophisticated AI security incident of 2026 was unfolding, the three biggest AI vendors were useless for the response. And then 37 companies formed a security alliance without them.
That's not a coincidence.
What the alliance is actually building
The practical output from the Open Secure AI Alliance (OSAA) so far includes two specific technical contributions:
NOOA — NVIDIA's Object-Oriented Agent framework, now open-sourced on GitHub. It covers identity, permissions, isolation, guardrails, logs, model formats, and multi-model coordination for AI agents specifically designed for security work. Unlike general agent frameworks, NOOA is built with the assumption that the agent will be handling malware, attack artifacts, and adversarial inputs. No commercial safety filter is going to shut down your analysis mid-incident.
MDASH — Microsoft's multi-model agentic scanning harness. It handles discovery, validation, triage, and patching, using Microsoft's MAI-Cyber-1-Flash model for 90% of tasks and routing the hardest 10% elsewhere. Microsoft announced MAI-Cyber-1-Flash on the same day — a 5B parameter model purpose-built for cybersecurity, delivering comparable performance to larger models at half the cost.
Both are open-source. Both are designed for security work where commercial safety filtering is a liability, not a feature.
What this means if you're not a large enterprise
The OSAA's founding members are not 15-person NGOs. They're companies with security teams, infrastructure budgets, and AI expertise. The tools they're building aren't going to ship a user-friendly GUI for a small operations team next week.
But two things are worth understanding now.
The security community has officially concluded that closed AI vendors are not suitable partners for security work. That's what the OSAA represents. It's not a niche opinion from one researcher — it's 37 companies putting their names on the same statement. If your organization is fully locked in to closed AI vendors and you experience a security incident involving AI systems, you may find that the tools you depend on are the exact tools that block your response. We wrote about how to prepare for this after the Hugging Face post-mortem.
The free tools are coming. Open-source security frameworks built on open-weight models will filter down. The NOOA framework is already available. Organizations that start building familiarity with open-weight models and local inference now — before they need it — will have options when something goes wrong. Organizations that have never touched anything outside a guardrailed commercial API will be improvising.
You don't need to run NOOA today. But you should know it exists and why it exists.
The practical setup that matters right now
We've recommended this before, but the Hugging Face breach and the OSAA announcement together make it more urgent: have a local AI path that isn't routed through a commercial API.
This doesn't require large infrastructure. Ollama runs on a server or even a workstation. Pull Llama 3.1 70B, Qwen3 32B, or Mistral 22B locally. For incident analysis tasks — parsing logs, analyzing malware behavior, correlating events — a mid-size open-weight model running locally will handle most of what you need. It won't refuse to read attack logs. It won't phone home with your data. And it costs nothing per query.
Document where that environment lives and how to use it. The worst time to set it up is while you're staring at a live incident.
The second thing: audit what you've locked in to. List out the AI tools and vendors your organization actively uses. For each one, ask: if this vendor's API went down, became unavailable in Canada, or refused to process security-related requests, what's our alternative? For most orgs, the answer is "we don't have one." That's the exposure. It doesn't require changing anything today — it requires knowing where you're exposed so you can make informed decisions.
The bigger picture
The OSAA's formation one week after the Hugging Face breach is not a reaction to a one-time incident. It's a response to a category of problem that is going to grow. As autonomous AI agents become more capable, incidents involving AI systems will require AI-assisted analysis to understand. The tools needed for that analysis cannot be built on foundations that filter out attack artifacts.
The three absent vendors may eventually join. They may build their own security-grade offerings. The safety guardrail problem is a product decision, not a technical impossibility. But right now, 37 companies have publicly said they're not going to wait for it to get resolved on someone else's timeline.
For a small org deciding what AI tools to invest in and how to use them: that signal is worth factoring in.
Understanding how your AI stack would hold up under pressure — and where the gaps are — is exactly the kind of review we do at the start of every sprint. Get in touch if you want to run that assessment.