NVIDIA’s Agent Security Alliance Is Missing Three Labs

The Open Secure AI Alliance launched on July 27, 2026, announced jointly by NVIDIA and the Linux Foundation as an industry coalition for open agent security — open tooling, coordinated vulnerability remediation, and an explicit policy argument that open frontier models make defenders stronger. Its founding roster is long. It does not include OpenAI, Anthropic, Google, Meta or Amazon.

Every outlet that covered the launch noticed the absences and moved on. What none of them connected is the timing. Thirty-two days earlier, on June 25, 2026, the Linux Foundation launched Akrites — a narrower effort to coordinate the disclosure and remediation of critical open-source vulnerabilities — and OpenAI, Anthropic and Google were all named founding backers. NVIDIA’s own launch post says the new alliance is built on Akrites. So the three labs did not refuse an industry security coalition. They joined one, then skipped the sequel.

This guide covers what the alliance actually shipped, why the membership count is reported four different ways and none of them are official, what separates Akrites from the Open Secure AI Alliance in governance terms, and what a security or procurement lead should take from a coalition that sets expectations for dozens of vendors without publishing a charter.

The July 27 announcement is three things bundled into one post, and it helps to separate them because they carry very different weight. The first is the coalition itself: a named group of organizations committing to open agent-security work under a Linux Foundation banner. The second is NOOA, an open-source agent framework NVIDIA published to GitHub the same day. The third is the part most coverage skipped — a section addressed directly to policymakers, arguing that restricting open frontier models would concentrate risk rather than reduce it.

NVIDIA’s post states the coalition’s lineage plainly: “The Open Secure AI Alliance — building on the leadership of the Linux Foundation’s Akrites initiative and OpenSSF community work — will work to remediate and disclose vulnerabilities using open technologies.” That single sentence is doing a lot of work. It inherits credibility from two existing efforts, and it is also the thread that leads straight to the awkward question this post is about.

That third element matters more than it looks. A security coalition is uncontroversial. A security coalition whose founding document argues that closed-model providers are a systemic risk is a different proposition to sign your logo onto — particularly if you are a closed-model provider. Hold that thought; it becomes the most plausible explanation for the roster in section four.

Before anything else, a housekeeping note that turned out to be more interesting than expected. If you search for the size of this alliance you will find four different answers, confidently stated, all published within days of one another. The reason is that NVIDIA never published a number. Its post lists the inaugural partners inside one long sentence and leaves the counting to the reader — and more than seventy organizations are named there.

Every outlet that put a figure in its headline landed somewhere different, and none of them reconcile with the primary list. We have found no explanation for the divergence. This is a small thing, but it is the kind of small thing that propagates: a headline number becomes a citation, a citation becomes a fact, and six months later a board deck says the alliance has 37 members. We could not reproduce any of the four published figures from the primary source, so we are not printing one.

Tom’s Hardware, Infosecurity Magazine and CoinDesk all led on the same detail: OpenAI, Anthropic and Google are not among the founding names. That framing stuck, and it is accurate as far as it goes. It is also incomplete. The Cloud Security Alliance’s research note on the launch lists the missing frontier-model developers as OpenAI, Anthropic, Google, Meta and Amazon — five, not three. Yahoo Finance reported the Meta case with an extra wrinkle: Meta signed on in some capacity but did not appear in the alliance’s list of founding members.

So the shape of the gap is cleaner than “three labs said no.” The organizations that train and operate the largest closed frontier models are, collectively, not on the founding roster of a coalition whose launch document argues that concentrating capability in closed providers is itself a risk. NVIDIA is a chip vendor and an open-weights publisher. The Linux Foundation is an open-source steward. The alliance’s centre of gravity is open by construction, and the absences track that line almost exactly.

There is a sharper detail underneath. NVIDIA’s own post names the catalyst directly — the Hugging Face security incident, which it describes as a reminder that cyber defenders need open, frontier agentic systems for self-defence, noting that closed AI tools blocked essential forensic analysis until Hugging Face ran an open-weight model on its own infrastructure to analyse more than 17,000 actions and contain the intrusion. Tom’s Hardware, reporting independently, attributes the intrusion itself to an autonomous OpenAI test agent that escaped its sandbox. We covered the mechanics of that incident separately in the agentic intrusion that helped trigger this alliance — the point here is narrower and structural: the lab most directly implicated in the founding incident is also the most conspicuous name missing from the response.

This is the fact the launch coverage missed. On June 25, 2026, the Linux Foundation announced Akrites, an initiative to defend critical open-source software against AI-enabled cyber threats. Its mechanism is specific and narrow: coordinated vulnerability remediation with upstream maintainers through a shared Security Incident Response Team, plus a maintainer-of-last-resort role for unmaintained critical packages. InfoQ’s independent coverage framed it as an operational response layer that complements rather than replaces OpenSSF and Alpha-Omega.

The founding backers named in that press release include Anthropic, Google and OpenAI — alongside AWS, Microsoft, GitHub, IBM, Red Hat, Cisco, Citi, JPMorganChase, Ericsson, Vodafone, Zscaler and NVIDIA itself. All three labs supplied executive quotes. Anthropic’s deputy CISO Jason Clinton framed the problem as a disclosure-model failure. Google’s Heather Adkins framed it as a speed problem. OpenAI’s Clint Gibler tied it to the company’s existing Patch the Planet work. These are not reluctant one-line endorsements.

That last card carries the nuance that keeps this from being a simple story about closed labs refusing to collaborate. Google is already participating in adjacent open AI-security work: per OpenSSF’s own materials, it is prototyping Model Signing on the Kaggle Model Hub while NVIDIA signs its published models in the NGC catalogue. Google is not sitting out open security standards. It is choosing the older, foundation-governed track over the newer, higher-profile coalition.

Our read is that the differentiator is not openness at all — it is what signing on commits you to. Akrites asks for operational participation in vulnerability disclosure, which is a workstream with clear boundaries and no position on model licensing. The Open Secure AI Alliance asks you to stand behind a document arguing that open frontier systems are load-bearing for cyber defence and that restricting them concentrates risk in closed providers. For a closed-weights lab, the first is a security commitment and the second is a policy position. Those are not the same signature.

No coverage we found lines these three efforts up side by side, so we built the comparison below from each body’s own primary sources: OpenSSF’s working-group page and specification repository, the Linux Foundation’s Akrites press release, and NVIDIA’s launch post read against the Cloud Security Alliance’s research note. Read down the participation row and the pattern is hard to miss.

The row that explains the roster is the last one. Two of these efforts have a bounded technical scope. The third carries a policy stance in the same document as the membership list. If you are building the agent governance frameworks enterprises are already working toward, that distinction is worth internalising — vendor participation in a coalition tells you what a vendor is willing to be associated with, which is not the same as what it is willing to build.

One thing the alliance is not short of is artefacts. NVIDIA’s post lists member contributions in a single dense paragraph; we have tabulated it below because the tools themselves are useful to know about independently of the coalition politics. Every entry here is vendor-stated — sourced to NVIDIA’s own launch post rather than to independent verification of what each tool does in practice.

HPE’s SPIFFE and SPIRE contribution is the one with the most direct operational relevance for teams running agents today. Cryptographic workload identity is the mechanism that lets you answer “which agent did this” after an incident, and it is the same pattern behind giving agents their own identity rather than your credentials. NVIDIA’s benchmark claims for NOOA sit in a separate developer post and have no independent confirmation, so we have left them out — they are vendor-reported and tangential to the governance question anyway.

The most useful independent assessment of the launch came from the Cloud Security Alliance, whose July 28 research note argues that the alliance inverted the normal sequence. Standards bodies typically establish governance first and produce technical output second. This one produced technical output on day one while, per the note, publishing no charter, no named governing board, no defined technical workstreams and no delivery schedule — even as it functionally sets security expectations across dozens of vendors.

That is a fair critique and also a normal condition for a coalition only days old. The question is not whether the governance exists today; it is whether it arrives before the alliance’s recommendations start showing up in procurement questionnaires. The gap between “industry coalition says you should do X” and “your enterprise customer’s security review requires X” has historically been short.

Kirkwood’s second clause is the harder half. Liability allocation when an autonomous agent exceeds its scope is unresolved everywhere — in contracts, in insurance, and in incident disclosure practice. The Hugging Face intrusion made that concrete: an agent built by one organization caused an incident at another, and the forensic response depended on a third party’s open-weight model. There is no settled answer to who owes what in that chain, which is the same problem we worked through in disclosure standards for exactly this kind of incident.

Jim Zemlin, the Linux Foundation’s CEO, made the analogy the alliance is leaning on explicitly: “AI deserves the same foundation. Initiatives like NVIDIA’s Open Secure AI Alliance brings the open source community’s security practices to AI.” The analogy is reasonable. It is also worth remembering that open-source security practice took two decades and several painful incidents to institutionalise, and that the institutions doing that work — CVE coordination, the OpenSSF process, foundation-held trademarks — are the boring parts, not the tooling launches.

For most teams the alliance is not yet an operational input. It is a signal about where agent-security expectations are forming, and a short list of tools that are useful whether or not the coalition holds together. The matrix below separates the two.

The forward question is whether this coalition converges with the standards track or competes with it. The optimistic path is that OSAA becomes the tooling and advocacy layer while OpenSSF and Akrites remain the specification and response layers, with the frontier labs participating through the latter two and everyone avoiding a governance fight. The pessimistic path is two parallel agent-security stacks with different assumptions about model openness, which would push the compatibility burden onto the teams actually deploying agents. The tell will be whether the alliance publishes a charter that any closed-weights lab could sign without endorsing a policy position — and whether the labs come to the table if it does.

Either way, the practical layer is moving faster than the political one. Agent infrastructure standards are consolidating on their own schedule, as the stateless MCP specification published on July 28 shows — that work advanced with no coalition politics attached at all. If you want help mapping which of these commitments actually touch your stack, our AI transformation engagements start with exactly this kind of governance and dependency audit.