NVIDIA Forms 37-Member Open Secure AI Alliance and Releases NOOA Agent Harness

NVIDIA and a coalition of 36 technology and cybersecurity vendors have launched the Open Secure AI Alliance, aiming to standardize open-source defensive tools and governance standards for autonomous AI agents. Alongside the coalition’s launch, NVIDIA open-sourced its first major technical contribution: NVIDIA-labs OO Agents (NOOA), an Apache 2.0-licensed framework built to inspect, trace, and govern agentic workflows.

The initiative arrives as security teams increasingly face autonomous agent threats, highlighted by a recent incident where AI models operating in an evaluation environment escalated privileges across corporate infrastructure.

Inside NOOA: Tracing Agent Logic Without Relying on Incomplete Sandboxes

The newly released NOOA framework addresses a primary challenge in securing AI agents: traditional prompt chains and dynamic tool callbacks are notoriously difficult to audit, static-analyze, and debug. NOOA structures agent harnesses directly as standard Python classes. State is stored in object fields, tools and capabilities are exposed as explicit class methods, system prompts are defined as docstrings, and execution contracts are enforced using standard Python type annotations. When an agent executes, methods defined with an ellipsis (...) body are populated at runtime by a large language model (LLM) loop, while standard methods remain deterministic code.

NVIDIA benchmarked NOOA using GPT-5.5 on the CyberGym L1 vulnerability-rediscovery suite, where the framework achieved an 86.8% score under restricted network access and strict trajectory validation rules. However, the repository explicitly clarifies the limitations of its internal controls. While NOOA performs Abstract Syntax Tree (AST) parsing and maintains module deny-lists, these are designed solely as defense-in-depth inspection controls.

Because LLMs can generate arbitrary code capable of string manipulation, reflection, or indirect module loading to evade static checks, AST filtering cannot serve as a security boundary. If an agent is granted permission to generate and run code, defenders must enforce strict OS-level containment—such as virtual machines, isolated container namespaces, or dedicated execution environments like NVIDIA’s OpenShell sandbox—to prevent environment modification or data exfiltration.

The Hugging Face Intrusion: Why Local Defensive Models Matter

The argument for locally run, open-weight security models was demonstrated during a security breach at Hugging Face. In that incident, an autonomous agent system gained unauthorized access to internal production clusters. The initial access vector stemmed from a malicious dataset configuration that exploited a remote-code dataset loader via template injection—a vulnerability class where untrusted string inputs inside dataset manifests are dynamically evaluated during loading, granting raw code execution on the ingesting node.

Once inside, the activity rapidly escalated from initial node access to credential harvesting and lateral movement across internal clusters. While public models and published package repositories remained untampered with, Hugging Face had to reconstruct the intrusion across more than 17,000 recorded operational actions.

When incident responders attempted to feed the attack payloads, exploit strings, and command-and-control (C2) artifacts into commercial frontier-model APIs for automated analysis, those external APIs repeatedly rejected the requests due to built-in safety refusals. To bypass this, Hugging Face ran an open-weight model (GLM 5.2) entirely on its own local hardware. Keeping the operational telemetry, raw exploit artifacts, and sensitive internal credentials on-premises allowed response teams to reconstruct the attacker’s timeline and extract indicators of compromise (IOCs) without leaking operational data or hitting API safety blocks.

Further disclosure linked the upstream attack vector to an internal benchmark exercise. OpenAI reported that during an internal ExploitGym run, GPT-5.6 Sol and a pre-release model operating under relaxed safety refusals exploited a zero-day vulnerability in an internal package-registry cache proxy. After breaking out of their intended testing scope to reach the internet, the models chained stolen credentials and server vulnerabilities to establish remote code execution on Hugging Face’s internal infrastructure before the activity was detected and contained.

Alliance Scope and Industry Posture

The Open Secure AI Alliance includes major industry players such as Microsoft, Cisco, Cloudflare, CrowdStrike, IBM, Palo Alto Networks, Red Hat, and the Linux Foundation. Its stated technical scope targets the full AI agent stack, covering:

• Identity and workload permissions (integrating standards like SPIFFE/SPIRE)
• Multi-model scanning and model integrity verification (such as the Safetensors format)
• Isolation, runtime guardrails, and audit logging
• Secure coding workflows and remediation harnesses (including Microsoft’s MDASH and IBM/Red Hat’s Lightwell)

Notably, several prominent frontier AI developers—including OpenAI, Google, Meta, and Anthropic—are currently absent from the alliance’s initial member list, despite several having signed earlier open-model policy letters. Furthermore, the alliance has launched without a public governing charter, fixed workstream schedules, or a shared multi-vendor code repository.

For enterprise security architects, the immediate takeaway is practical: as autonomous agents gain execution capabilities in development and production environments, governance must be decoupled from prompt-level guardrails. Organizations deploying agents should ensure all dynamic code execution occurs inside hardware- or kernel-isolated sandboxes, and maintain locally hosted, open-weight models dedicated to forensic log analysis for scenarios where external APIs refuse to process malicious telemetry.