The Linux Foundation has published a Request for Comments on the Shared AI Findings Exchange, or SAFE, a proposed framework for collecting and sharing information about cybersecurity incidents involving AI agents. The initiative is being developed by the Open Secure AI Alliance as companies move from model testing toward systems that can access tools, data and enterprise applications.

NVIDIA, Cisco, CrowdStrike, Hugging Face and Red Hat are among the organizations contributing to the proposal, according to an NVIDIA blog post. The alliance says it now includes more than 120 organizations. The central idea is to turn confidential reports about incidents and near misses into evidence-based guidance that can help other developers avoid the same failures.

SAFE targets the operational layer of AI security

The SAFE proposal goes beyond conventional vulnerability disclosure. The guidelines described by NVIDIA call for confidential collection and analysis of AI-related incidents, notification of affected parties, identification of recurring control failures and publication of operating recommendations intended to reduce systemic risk.

That scope reflects a change in how AI systems are being built. An agent is not only a model; it may also include an orchestration harness, identity controls, tools, runtime restrictions, guardrails, logging and evaluation systems. A weakness in any of those layers can affect what an agent is able to see, access or change.

For builders, a shared incident format could make agent security failures easier to compare across products and deployments. Today, information about prompt injection, tool misuse, leaked credentials or unsafe autonomous actions may remain inside individual companies. SAFE’s proposed approach is intended to create a mechanism for sharing lessons without immediately exposing sensitive operational details.

The proposal remains a draft. The available announcement does not specify the full reporting taxonomy, governance model, participation requirements or timeline for finalizing the guidelines.

The alliance is pairing reporting with open tools

NVIDIA presented SAFE alongside a wider set of security contributions from Open Secure AI Alliance members. Its own examples include the NVIDIA Labs Object-Oriented Agent research harness, which the company says is designed to make agent behavior easier to test, trace and audit, and NVIDIA OpenShell, a runtime intended to limit what an agent can access and do.

NVIDIA also highlighted Garak, its open-source large language model vulnerability scanner, which checks for issues such as data leakage, prompt injection and jailbreak behavior. Other named tools include NeMo Guardrails, NeMo Anonymizer and NeMo Safe Synthesizer, covering policy enforcement, sensitive-data protection and privacy-oriented synthetic data generation.

Several alliance members are contributing tools at different points in the stack. Okta is developing reference implementations for agent identity and access using Cross App Access. Palo Alto Networks has contributed Agent Guard and Agent Watch from its Idira identity-security platform. Red Hat has introduced asago, an open-source project that maps governance requirements to runtime permissions and audit records, according to NVIDIA.

Amazon, described as a new alliance member in the post, is contributing Strands Agents and Cedar. Strands Agents is an open-source toolkit for building agents, while Cedar is an authorization language designed to define and enforce access boundaries. These projects address implementation questions that SAFE alone cannot solve: what an agent can do, which identity it uses and how those decisions are recorded.

Evidence is currently based on participant reporting

The core news is confirmed by the NVIDIA source: the Linux Foundation has issued an RFC for SAFE, and an Open Secure AI Alliance working group is contributing to it. The membership count and descriptions of the participating tools also come from NVIDIA, an alliance member with a direct interest in promoting open AI-security infrastructure.

The available source does not include independent testing of SAFE, evidence that the framework has been adopted by enterprises, or proof that the listed tools reduce incident rates in production. Claims about the capabilities of NVIDIA’s products and the contributions of other members should therefore be treated as vendor or participant descriptions rather than independently verified performance findings.

There is also no indication yet that SAFE has become a formal standard. An RFC creates an opportunity for review and revision, but its practical value will depend on whether organizations agree on what to report, how incidents are anonymized and how quickly useful findings reach developers and operators.

Why the proposal matters to AI teams

For product teams deploying agents, the most important potential benefit is operational learning. A common reporting structure could help security engineers distinguish isolated model behavior from failures caused by permissions, tool integrations, orchestration logic or weak monitoring. That distinction matters because changing the model may not fix a vulnerability that exists in the surrounding system.

Enterprise buyers may also look to a mature SAFE process when assessing vendors. They could ask whether an AI provider participates in incident disclosure, how it handles near misses and whether its controls are mapped to concrete evidence. But those benefits will materialize only if the framework produces consistent, actionable reports rather than broad warnings that are difficult to apply.

The initiative also highlights a competitive tension in AI infrastructure. Open-source security tools can improve inspection and portability, while shared reporting can expose repeated weaknesses across vendors. At the same time, companies may hesitate to disclose incidents involving customer data, proprietary systems or reputational risk. SAFE’s confidentiality and governance rules will be central to resolving that tension.

What to watch next

The next signal will be the content of the Linux Foundation’s feedback process: specifically, whether SAFE defines a usable incident schema, clear protections for sensitive information and responsibilities for notifying affected organizations.

Developers should also watch for evidence of implementation rather than additional membership announcements. Useful indicators would include published anonymized incident reports, integrations with agent observability and evaluation tools, and examples showing how a shared finding led to a change in permissions, runtime controls or deployment policy.

Finally, the market will need to see whether SAFE connects with existing security and governance frameworks, including NIST and OWASP guidance, without creating another disconnected compliance layer. Adoption by organizations outside the founding alliance would be a stronger test than the current participant count.

Creati.ai perspective

SAFE addresses a real weakness in agent security: teams are being asked to manage systems that can act across models, tools and enterprise resources, while much of the available knowledge remains fragmented. A shared process for incidents and near misses could make defensive engineering more cumulative instead of forcing every company to rediscover the same failure modes.

But the proposal’s credibility will rest on execution. The framework needs precise reporting rules, incentives for candid participation and enough technical detail to produce controls that builders can actually deploy. Until those elements are visible, SAFE is best understood as an important standards effort—not yet a demonstrated security solution.