Source: NVIDIA Blog — 2026-08-04
Summary
Nvidia VP Justin Boitano detailed the Open Secure AI Alliance's growth to 120+ member organizations — including Nvidia, Cisco, CrowdStrike, Hugging Face, and Red Hat — working with the Linux Foundation on a Shared AI Findings Exchange (SAFE) RFC, a proposed standard for reporting agentic AI security incidents modeled explicitly on aviation's incident-reporting culture. Boitano compares the mechanism to an aircraft's flight recorder: preserve the evidence, notify affected organizations quickly, and file a confidential report within days so the industry can learn from near-misses the way aviation does.
Key Takeaways
- The alliance grew from 37 members at its July launch to 120+ by early August — rapid membership growth for a voluntary industry security initiative.
- SAFE is explicitly modeled on NASA's aviation safety reporting system, where near-misses and incidents get reported confidentially so the whole industry learns from them, rather than each organization hiding its own failures.
- The proposed incident lifecycle has four concrete steps: detect an incident, preserve evidence (prompts, agent traces, tool calls, identities, permissions, credentials), notify affected organizations as soon as possible, and submit a confidential initial report within 4 business days.
- Defined reportable triggers include unauthorized third-party system access or exploitation, confidential-data breaches, and continued probing after suspected unauthorized activity — explicitly including near-misses, not just confirmed breaches.
- Five named organizations — Nvidia, Cisco, CrowdStrike, Hugging Face, Red Hat — are drafting the actual RFC with the Linux Foundation, giving the proposal real technical-standards backing rather than being purely a marketing coalition.
Reel Script
Hook: When an AI agent gets hacked or hijacked today, the company it happened to usually just quietly fixes it and says nothing. Nvidia and over a hundred other companies want to change that — by literally copying how the aviation industry handles near-misses.
Core Concept: Aviation has one of the best safety records of any industry, and a big reason is a specific cultural mechanism: when something goes wrong — or almost goes wrong — pilots and airlines file a confidential report describing exactly what happened, and that information gets shared across the whole industry so everyone learns from one organization's near-miss instead of waiting for their own. AI agent security has the opposite culture right now: incidents get patched quietly and buried, because disclosing an AI agent security breach carries reputational risk with no shared upside. The Shared AI Findings Exchange, or SAFE, is a proposed standard trying to import the aviation model directly — Boitano's own framing is that an AI agent needs something like a "flight recorder," a preserved record of exactly what happened during an incident, submitted confidentially so the pattern can be recognized industry-wide before it repeats elsewhere.
Hands-On: The lifecycle worth diagramming has four clean stages: detect that something happened — unauthorized access, a data breach, suspicious probing that continues after you've flagged it; preserve the evidence immediately, meaning the actual prompts involved, the agent's full trace of tool calls, which identities and permissions and credentials were in play; notify any other organizations affected as soon as possible, since an agent security incident often touches more than one company's systems; and file a confidential initial report within four business days, feeding into the shared exchange. What makes this more than a talking point is who's actually drafting the RFC — not just Nvidia's PR team, but Nvidia, Cisco, CrowdStrike, Hugging Face, and Red Hat working directly with the Linux Foundation, the same body that stewards a lot of real open-source infrastructure.
Takeaway: If your organization runs AI agents with real permissions and real tool access, treat this as a preview of where incident-response expectations are heading, not just an industry press release — start preserving agent traces and tool-call logs now, before a shared reporting standard makes it mandatory. The companies building this are the same ones whose security tooling you're probably already running.