SAFE (Shared AI Findings Exchange) is a Linux Foundation RFC from the 120+ member Open Secure AI Alliance: confidentially collect agentic AI incidents and near misses, notify those impacted, identify recurring control failures, and publish evidence-based operating recommendations
The framing to steal: an agent is not a model, it is a system - identity, harness, guardrailsThe checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.Full definition →, logs, evaluation - so securing it takes layered controls, not vulnerability scanning.
The open defensive stack is filling in fast: Okta Cross App Access for agent identity, Amazon Cedar for deterministic authorization, NVIDIA OpenShell runtime sandboxing, Cisco DefenseClaw governance on top of it, and Microsoft PyRIT/RAMPART/Assert for red-teaming and executable s
Signed, auditable agent skills are emerging as a trust layer: NVIDIA catalogs skills, scans them for prompt injectionAn attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.Full definition → and tool poisoning, cryptographically signs them, and documents each with a agent skillA reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.Full definition → card.
Specialized small security models are outperforming generalists: CrowdStrike-tuned Nemotron Nano hit 96% accuracy generating investigation queries and beats much larger models on SOC triage with calibrationHow well a model's confidence matches reality — a calibrated model saying "90% sure" is right about 90% of the time.Full definition →, auditable confidence.
Terms in this piece · Glossary
guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
agent skill — A reusable instruction file that teaches an agent how to do one job well — the procedure, the tools, and what counts as done.
calibration — How well a model's confidence matches reality — a calibrated model saying "90% sure" is right about 90% of the time.
Why it matters
The SAFE RFC proposes a confidential mechanism to share agentic AI security incidents and publish evidence-based control recommendations, and surfaces open source tools across identity, harnessing, vulnerability scanning, and resilience that engineers can adopt now.
Key quotes
“Cybersecurity is a race without a finish line.”
“An AI agent isn’t just a model.”
“If a model is the agent’s brain, the harness is the body that takes action by using tools.”
podcast9/18: Frontier Labs and Independent EvaluatorsMTS
articleWhere Security Fits in an AI Agent StackMichelle Horton
articleAI Security Priorities: A Field-Wide AgendaGil Gekker, Rachel Steratore, Everett Smith, Asher Brass-Gershovich, Varun Gandhi, Nicole Nichols, Vijay Bolina, Buck Shlegeris, Lisa Einstein, Dan Lahav, Omer Nevo, Sella Nevo