The big topic of July was the breach at Hugging Face - the incident that showed AI agents are now worker, weapon and vulnerability all at once. On 27 July came the industry's answer. Not a product. An alliance.
Fact
The facts: On 27 July 2026 NVIDIA announced the Open Secure AI Alliance - an initiative of over 40 organizations, including Microsoft, IBM, Red Hat, Cloudflare, Hugging Face, CrowdStrike, Palo Alto Networks, Salesforce, Siemens, SAP and the Linux Foundation. The goal, in their words: 'defenders everywhere have open, best-in-class tools they trust and control.' It builds on the work of the Linux Foundation and the OpenSSF community. Commitments announced by the companies themselves: NVIDIA is contributing open models, weights and an agent framework; Hugging Face is offering its secure model format Safetensors to the PyTorch Foundation; Microsoft is releasing an agent code scanner with several models; IBM and Red Hat are extending protection along the open-source supply chain. The investigation into the Hugging Face incident analyzed over 17,000 agent actions - with an open model. Source: NVIDIA, 27.07.2026.
The interesting part is who's sitting at the table. CrowdStrike and Palo Alto Networks make their living selling protection. NVIDIA and Microsoft compete for the same customers. When players like that agree to share their defensive tools, that says something about the size of the problem - nobody believes they can keep agents safe alone.
Attackers have long used open tools. The question was when defense would start speaking the same language.
And one caveat. An alliance is announced with a press release, and proven with code in a repository. The list of names is impressive, the commitments sound concrete - but they only become concrete once something real gets uploaded and put to use. We're noting down what was promised on 27 July. We'll open the repositories in a few months and check what's actually there once the noise dies down.
Official primary sources
NVIDIA - Open Secure AI Alliance, 27.07.2026The visual is generated code-art, no third-party images.