Inside SAFE: The Industry's Plan to Report Rogue AI Agents

When an autonomous AI agent broke into Hugging Face's infrastructure this summer, it exposed a gap: the security playbooks built for human attackers and ordinary software don't map onto agents that navigate tools and networks on their own. The industry's response is now taking shape as a reporting standard.

The Open Secure AI Alliance, an NVIDIA-led coalition launched July 27 with Microsoft, Cisco, CrowdStrike, and IBM among its members, has since grown past 120 organizations. Its centerpiece is SAFE, the Shared AI Findings Exchange, a proposed framework for documenting incidents where agents misbehave, notifying affected parties, and sharing the lessons. The Linux Foundation opened SAFE for public comment in mid-August.

How SAFE would work

The model is borrowed from aviation, where near-misses feed a shared investigation system instead of getting buried; Nvidia's Justin Boitano has made that comparison directly. Under the draft, a member that hits an agent-security incident files a confidential report within four business days, with public disclosure and remediation updates later when appropriate. The goal is to turn one company's bad day into everyone's early warning, so a novel attack on one team becomes a documented pattern the rest of the industry can defend against.

What members are shipping

The tooling matters more than the manifesto. CrowdStrike fine-tuned NVIDIA's Nemotron Nano for cyber defense, reporting 96% accuracy generating investigation queries in Falcon LogScale. Cisco open-sourced two of its Antares security small language models for finding known vulnerabilities in code, plus Project CodeGuard for secure-by-default AI coding. The work builds on existing Linux Foundation and OpenSSF security efforts rather than starting cold.

The catch worth watching

SAFE's weakness is structural: it's voluntary, and it offers no legal safe harbor. A company that reports its agent breaching a customer's system also hands regulators and lawyers a paper trail. Aviation's reporting culture works partly because disclosure is protected; SAFE, as proposed, isn't. Without that, the incidents most worth sharing, the embarrassing ones, are the ones firms will be tempted to sit on.

If you already run agents in production, the practical read is simpler: a formal category for "the agent did something it shouldn't have" is coming, so decide now how you'd detect and log it yourself — what your agents may touch, how you'd know one crossed a line, and who gets paged when it does. It also arrives as frontier models get more capable and far cheaper, which means more teams will be running more agents, in more places, very soon. The standard is still a draft. The failure mode it describes already happened.