A few days ago, NVIDIA, Microsoft, Meta, IBM, Palantir and a growing list of technology companies signed the “Open Weights and American AI Leadership” letter. The letter made an important case against premature government restrictions on open-weight models. It argued that openness expands access, encourages competition, gives organizations greater control over their technology and makes advanced AI capabilities available to defenders as well as attackers.
I agreed with much of it.
But a letter is still a letter. Signing one is relatively easy, especially when the principles are broad enough to accommodate companies with very different definitions of openness and very different economic interests in the outcome. It is a statement of intent—perhaps even a show of solidarity—but it does not require anyone to build, fund or maintain anything.
NVIDIA’s newly announced Open Secure AI Alliance is something else. This is not another collection of logos attached to a declaration. Its members are contributing technology, research, security expertise and engineering resources. NVIDIA is releasing its NOOA agent-harness research framework. Microsoft is contributing MDASH, a multi-model scanning harness. HPE brings its work around SPIFFE and SPIRE for cryptographic workload identity. Hugging Face has offered Safetensors to the PyTorch Foundation. IBM and Red Hat are bringing Lightwell for digitally signed open-source patches. SpaceXAI has open-sourced its Grok Build coding agent and says it plans to release weights from the Grok model family.
CrowdStrike, Elastic, Palo Alto Networks, Cloudflare, Cisco, Databricks, Salesforce, SAP, ServiceNow, the Linux Foundation and dozens of other organizations are also inaugural members.
This is more than feigned solidarity. It is the beginning of an attempt to build a shared security commons for the AI era.
That deserves recognition. It also raises two questions that will determine whether the Open Secure AI Alliance becomes a lasting institution or remains an impressive NVIDIA-led initiative.
Who will own and govern the commons?
And will the companies building the world’s leading AI models commit themselves to it?
Defenders Cannot Always Wait for Permission
The alliance’s premise is rooted in a real security problem.
During the recent intrusion at Hugging Face, closed AI services reportedly blocked forensic analysis because their safeguards could not distinguish between malicious activity and legitimate defensive investigation. Hugging Face eventually ran the open-weight GLM 5.2 model on its own infrastructure, using it to analyze more than 17,000 attacker actions and help contain the incident.
The lesson is not that open models are inherently secure while closed models are inherently dangerous. That is too simplistic, and NVIDIA does not make that claim. Open models can be abused, modified and stripped of safeguards. Closed systems can provide protections, monitoring and managed controls that many organizations could not build themselves.
The lesson is that defenders sometimes need to inspect, adapt and operate their security intelligence without asking an outside provider for permission.
When an intrusion is unfolding, a defender cannot afford to have a provider’s acceptable-use system misunderstand the investigation and block the tools needed to respond. Nor should a government agency, critical infrastructure operator or enterprise be forced to send its most sensitive telemetry to an outside model provider simply to understand what is happening inside its own environment.
Organizations need choices. Sometimes the right choice will be a proprietary frontier model. Sometimes it will be an open-weight model running locally. Often, it will be several models working together.
The security architecture needs to support all of them.
That is one of the strongest elements of the alliance. It recognizes that an agent is not merely a model. An AI agent is a complete system of models, harnesses, identity, permissions, tools, guardrails, logs, evaluation and infrastructure. Securing the model without securing everything around it is like putting a stronger lock on the front door while leaving every window open.
CrowdStrike offered a particularly useful example. In its testing, comparable frontier models placed inside different harnesses produced dramatically different results. A generic implementation generated false-positive rates approaching 80%. A security-specific harness reduced that rate to approximately 20% while preserving the system’s ability to find vulnerabilities. The underlying class of model remained similar. What changed was how the model was given context, permitted to act and required to validate its conclusions.
The model matters. The system humans build around it can matter just as much.
This reinforces a point I made following the Hugging Face incident: Blaming agents is not a security strategy. Humans remain responsible for the identity, permissions, isolation, observability and governance surrounding them. The Open Secure AI Alliance appears to understand that AI security is a full-stack responsibility.
The Indispensability Trap Comes to Cybersecurity
NVIDIA also warns that restricting open frontier systems could concentrate “power, dependence and vulnerability” in a few closed providers.
That sounds like language lifted directly from The Indispensability Trap, my forthcoming book.
Once a technology provider becomes essential to the operation of an industry, government or economy, its indispensability stops being only a source of strength. It becomes a systemic risk. Customers lose leverage. Alternatives disappear. Prices become harder to resist. Policy begins bending around the provider because allowing it to fail—or even allowing it to withdraw its services—becomes unthinkable.
Now apply that trap to AI security.
If critical infrastructure can be defended only through models and security controls operated by a handful of outside companies, those providers become essential points of dependency. The intelligence protecting an organization can be filtered, restricted, repriced or withdrawn by someone else. A policy change, commercial dispute, service failure or geopolitical decision can suddenly limit an organization’s ability to defend itself. An organization cannot claim sovereignty over its security when it does not control whether its security intelligence remains available.
The answer is not to reject proprietary AI. NVIDIA is explicit that the world needs both closed and open models. The answer is to ensure that the common security architecture surrounding those models is transparent, independently testable and broadly available.
Open secure AI does not require every AI model to be open. It requires AI security to be developed in the open.
Who Owns the Commons?
This brings us to the alliance’s first unanswered question.
NVIDIA has announced an alliance, a mission, a substantial membership roster and an initial collection of contributions. What it has not announced—at least not yet—is a public charter, independent board, technical steering committee, membership structure, transparent funding model or neutral institutional owner.
The Linux Foundation is an inaugural member, and the alliance says it will build on the Linux Foundation’s Akrites initiative and OpenSSF community work. That is encouraging. But participation by the Linux Foundation is not the same as governance by the Linux Foundation.
If NVIDIA continues to convene, fund, brand and direct the alliance, this remains NVIDIA’s initiative, even if all the technology is open source. The alliance would itself depend on one indispensable corporate sponsor, recreating the problem it is intended to prevent. The whole undertaking needs one neutral home.
There will be a temptation to divide its components among existing organizations. The cloud-native infrastructure could go to CNCF. Software supply-chain security could go to OpenSSF. Models, datasets and evaluations could go to LF AI & Data. Other pieces might fit inside the AI Alliance or the PyTorch Foundation.
That might look wonderfully organized on a diagram. In practice, it could gut the mission.
Each foundation has its own charter, board, technical committees, contribution process, budget and roadmap. Dividing the Open Secure AI Alliance across them would produce several individually sensible projects without anyone remaining accountable for whether the complete defense system works.
Attackers will not respect foundation boundaries. Defenders should not have to navigate four foundations to assemble one functioning defense.
The better answer is one umbrella foundation—perhaps an Open Secure AI Foundation housed under the Linux Foundation—with a single charter, governing body, technical roadmap and budget. It could maintain specialized workstreams for agent identity, harness security, isolation, model evaluation, secure development, incident response and supply-chain integrity. CNCF, OpenSSF, LF AI & Data and other communities could contribute expertise without dividing ownership of the overall mission.
One foundation. One mission. One accountable roadmap.
NVIDIA May Have Already Shown Its Hand
There is evidence that neutral stewardship may already be part of NVIDIA’s plan.
NVIDIA recently joined the CNCF Governing Board and committed $4 million over three years so CNCF projects can perform continuous integration and testing on real GPUs rather than relying on emulators. It contributed its GPU Dynamic Resource Allocation driver upstream and placed KAI Scheduler—the technology NVIDIA itself uses for scheduling large AI clusters—into the CNCF Sandbox.
NVIDIA described its operating philosophy in unusually direct terms:
“Contribute upstream first, share governance rather than control it.”
That matters. NVIDIA did not merely donate code it no longer needed. It contributed important infrastructure and scarce GPU capacity to a community it does not exclusively control. It said foundational AI infrastructure should be a community asset.
The Open Secure AI Alliance may be the next application of that same playbook: Assemble the companies, start the work, establish the initial projects and then transfer the undertaking to neutral community governance.
If that is the plan, NVIDIA should say so. The company deserves credit for convening the alliance. It should not be expected to operate the commons forever simply because it was willing to start it. Giving the initiative an independent institutional life would be evidence that NVIDIA means what it says about sharing governance.
Where Are the Model Makers?
The second question is not where the models are. The alliance does not need to develop a single open model to power everything it does.
The more consequential question is where some of the world’s largest model makers are.
Microsoft, IBM, NVIDIA, Databricks, Salesforce, Nous Research, Reflection AI, Thinking Machines Lab, NAVER and SpaceXAI provide substantial model expertise. Yet OpenAI, Anthropic, Google DeepMind, Meta and Mistral are conspicuously absent from the alliance’s inaugural roster.
Some of those companies supported the open-weights letter. Joining a working security alliance is a more substantive commitment.
These companies should not be required to donate models, publish weights or abandon their business models. OpenAI and Anthropic do not need to become open-model companies to participate in open AI security. They should be asked to contribute security research, threat intelligence, testing interfaces, evaluation results and engineering expertise. They should help define, validate and adopt common practices for identity, permissions, harness security, logging, incident response and responsible disclosure.
The alliance should be where the entire model industry collaborates on security, not merely where infrastructure and cybersecurity companies attempt to secure models from the outside.
Security is one of the few areas where collaboration among fierce competitors is both possible and necessary. We have seen it with vulnerability disclosure, threat-intelligence sharing, open-source software and industry standards. Companies can still compete on model performance, products, services and customer experience while cooperating on the practices that make the whole ecosystem safer.
Elastic’s commitment illustrates the opportunity. It plans to contribute research, tools and architectural knowledge to the alliance while continuing to compete commercially in search, observability and security. Its argument is that every barrier to sharing defensive intelligence becomes a liability when adversaries are also using AI.
That same logic should apply to the frontier model companies.
Aligned Incentives Still Count
NVIDIA is not doing any of this out of pure altruism.
The more models, agents and AI applications that are created, the more accelerated computing the world will consume. NVIDIA benefits from model diversity, open development and the diffusion of AI into every company and industry. It can oppose concentration at the model layer while remaining extraordinarily powerful at the compute layer.
NVIDIA is fighting concentration above it while remaining indispensable beneath it.
That tension should not be ignored. It should not be used to dismiss the company’s contribution either. Open source has often advanced because commercial interests and community interests aligned. Linux, Kubernetes and the modern cloud-native ecosystem were not built solely through acts of charity.
NVIDIA has put technology, expensive GPU capacity and organizational energy behind its argument. That counts for considerably more than pretending it has no economic interest in openness.
The industry letter showed that many companies are willing to say the future of AI should remain open. The Open Secure AI Alliance shows that some are willing to begin building the security commons that future will require.
Now comes the harder part.
NVIDIA should place the entire undertaking—not a scattering of its projects—under one neutral roof. The alliance should challenge every major model maker, open or closed, to help build, test and adopt its work.
This is a serious and unusually substantive initiative. But openness is not established by an announcement or an impressive launch roster. It will be demonstrated by the governance NVIDIA is prepared to surrender and the industry participation the alliance can attract.
NVIDIA built the alliance. The best thing it can do now is give it away.