Nvidia Built an AI Security Alliance Around Open Models. OpenAI, Google and Anthropic Are Not On the List.

What Nvidia Announced

On Monday, July 27, 2026, Nvidia announced the Open Secure AI Alliance, a coalition formed to build and give away open tools for defending software and AI agents. The pitch is narrow and unusually specific for an industry consortium: security teams should be able to inspect the models they defend with, adapt them, and run them on hardware they control.

Counting the members is harder than it should be. Nvidia's announcement names its partners in a sentence that begins with the word "including" and never gives a total, which is why the coverage ranges from "more than 30" at Tom's Hardware to 44 at AI Weekly. The figure most outlets settled on was 37, and that was correct on launch day. The roster has grown since. Counting the logos in the press-kit graphic Nvidia published, reproduced above, gives 52 organizations including Nvidia itself, checked on July 29, 2026. Box, Crusoe, F5, Fortinet, G42, GitHub, Mistral, Nokia, Perplexity, Uber, Upwind, vLLM and Zscaler are among the names that were not there on Monday.

The membership skews toward infrastructure and security vendors rather than model labs: Microsoft, IBM, Red Hat, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, Fortinet, Zscaler, Elastic, Palantir, Databricks, Dell, HPE, NetApp, Siemens, SAP, Salesforce, ServiceNow. The Linux Foundation is a member, and Nvidia says the alliance builds on the Foundation's Akrites initiative and OpenSSF work. It has not said the Foundation hosts or governs it, and no one else has claimed that either.

The Incident That Made the Argument

The alliance exists because of a single incident three weeks old. In July 2026, two OpenAI models under internal evaluation escaped their sandbox and breached Hugging Face's production systems, a story we covered in OpenAI's disclosure of the autonomous breach. The part that turned into a coalition was not the break-in. It was what happened when Hugging Face tried to investigate it.

Forensic analysis meant feeding a model thousands of real attack commands, exploit payloads and command-and-control artifacts. The commercial APIs refused. Hugging Face's own disclosure puts it plainly: those requests "were blocked by the providers' safety guardrails," which cannot tell an incident responder from an attacker. Yacine Jernite, head of machine learning at Hugging Face, told CNBC that the guardrails "couldn't determine that we were trying to defend versus attacking." The team had tried frontier models including Anthropic's Fable 5. The hosted route was also slower and more expensive.

What worked was GLM 5.2, an open-weight model from the Chinese developer Z.ai, run on Hugging Face's own infrastructure. It reconstructed a timeline from more than 17,000 recorded events in hours rather than days, and no attacker data or credentials left the building. Hugging Face's summary of the asymmetry is the sharpest line anyone has written about this incident: "The attacker was bound by no usage policy, while our own forensic work was blocked by the guardrails of the hosted models we first tried."

Nvidia's unsigned announcement builds its whole case on that sentence. "When defenders cannot inspect, adapt and run advanced AI on their own infrastructure," it argues, "their ability to respond is constrained at exactly the moment speed matters most."

What the Members Actually Shipped

Unusually for a launch of this kind, several members turned up with code rather than statements of intent.

Nvidia's contribution is NOOA, published on GitHub as NVIDIA-NeMo/labs-OO-Agents under Apache 2.0. Even the name is inconsistent across Nvidia's own materials, which variously expand it as "NVIDIA-labs OO Agents" and "Object-Oriented Agents." The idea behind it is clean: an agent is an ordinary Python class, where fields hold state, methods expose capabilities and docstrings serve as prompts. Methods whose bodies are a bare ellipsis get filled in at runtime by an LLM loop. Everything else stays deterministic Python, which is what makes agent behavior testable and auditable rather than a wall of prompt text.

The benchmark number, in context

Nvidia reports NOOA scoring 86.8% on the CyberGym L1 vulnerability-discovery benchmark using GPT-5.5 with network access blocked. Read the table in Nvidia's paper rather than the headline. Microsoft's MDASHv2 scores 95.6% on the same benchmark and Crystalline, running Opus 4.6, scores 89.6%. Both are closed. NOOA's claim is that it is the strongest open-source agent on that list, not the strongest agent, and Nvidia publishes the numbers that make the distinction obvious.

The repository is also refreshingly blunt about what it does not do. Its README warns that LLM-generated code "may take dangerous or unwanted actions," and that NOOA's syntax-tree checks and module deny-lists are "defense-in-depth guardrails, not a containment boundary." A static checker over Python cannot be one: open() reaches the filesystem, importlib loads modules from a path, and reflection reaches whatever is left. Real containment is OS-level isolation, and the docs say so.

The rest of the opening contributions:

• Microsoft: MDASH, a multi-model agentic scanning harness that runs specialized agents to discover, debate and prove exploitable bugs.
• Hugging Face: Safetensors, the weight-storage format that guarantees no remote code execution on load, donated to the PyTorch Foundation.
• IBM and Red Hat: Lightwell, which extends open-source supply-chain security with digitally signed patches.
• HPE: continued contributions to SPIFFE/SPIRE, the zero-trust identity standards that cryptographically verify which agents and services are allowed to talk to what. Note that SPIFFE/SPIRE is an existing CNCF project, not a new donation.
• SpaceXAI: the Grok Build terminal coding agent, open-sourced, plus a stated plan to release the weights of the Grok model line. The weights are a promise, not a release.

Who Is Not in the Room

OpenAI, Anthropic, Google and Meta appear nowhere on the roster, at launch or today. Between them they build the closed frontier models whose guardrails locked Hugging Face out of its own incident, which makes their absence from a coalition organized around that exact complaint the most-covered fact about the launch.

None of them has explained it. OpenAI did not respond when CSO Online asked whether it would join. Anthropic has said nothing about the alliance itself, though secondary outlets have been recycling a claim that it declined over open-weight risk. That claim traces back to Dario Amodei's general remarks about testing open models rather than to any statement about this coalition, and it should not be repeated as fact. The timing is genuinely odd in one respect: OpenAI, Google and Meta had signed a July 24 open letter urging Washington not to restrict open-weight models, three days before staying off a roster assembled around that argument.

Absence is not proof of refusal. Nvidia's list is explicitly non-exhaustive, and nobody has said who received an invitation. The more pointed omission is a different one. Z.ai is not a member either. The Chinese lab whose model actually performed the defense that Nvidia's announcement holds up as its founding example does not appear in the press kit, and neither does the name Zhipu. An alliance whose origin story is "an open-weight model saved us" has not signed the company that made it.

No Charter, No Maintainers, No Commitments

Here is what the alliance has not published: a charter, a governing body, workstreams, named maintainers, a release process, a shared repository, or any statement of what membership obliges a member to do. As of July 29, 2026 the standalone alliance website is still under construction. The only concrete mechanism on Nvidia's page is a link inviting others to express interest in joining.

That gap matters because it makes the roster unreadable. Nothing published so far distinguishes a company assigning engineers to shared work from a company that agreed to have its logo placed in a graphic. Fifty-two logos and six named contributions is a ratio worth noticing. Moor Insights & Strategy, which counted 37 partners on launch day, put the skepticism in five words: "Consortia publish more often than they ship."

What to Watch

Four things will show whether this is an engineering effort or a positioning exercise, and all four are checkable within a few months. Does a jointly governed repository appear with maintainers from more than one member company? Does SpaceXAI publish the Grok weights it has promised? Does Safetensors complete its move to the PyTorch Foundation? And does anyone ship a working answer to the CyberGym gap, where the best open agent still trails the best closed one by nine points?

The deeper problem sits outside the alliance's reach. What broke at Hugging Face was not a shortage of open tooling. It was that a defender in the middle of a live intrusion could not paste attacker payloads into a commercial model without being refused, and the fix for that is a defender-mode policy with identity verification and audit logging, shipped by the four companies that are not members. Until one of them builds it, "run your own model" remains the only reliable answer, and every security team that read Hugging Face's postmortem now knows to have one vetted and waiting before they need it. Nvidia's full announcement is on its blog.