Nvidia Defends an Open AI Alliance With a Closed Queue

Mark Weatherford said in Prague on October 7 that the Linux Foundation is still vetting hundreds of companies for Nvidia’s Open Secure AI Alliance. The foundation said that day that more than 150 organisations have already joined, with its first shared-incident guidelines due later this month.

Weatherford, Nvidia’s head of cybersecurity policy, told the Open Source Summit Europe crowd that the chipmaker wants to get in front of White House and congressional talks on new rules for closed models, open models, and open source. OpenAI, Google, Anthropic, and Meta are not on the roster he was asked to defend.

Hundreds of Companies Are Still Waiting in Line

The question in Prague was whether the alliance is a gesture that rivals will ignore once they have to share tools and incident data. Weatherford did not promise they would share. He pointed at the line of applicants instead.

There are a number of big companies that are not signatories to this. I would just say that there is a queue of a lot of companies that still have not been vetted and approved into the alliance by the Linux Foundation. They are working through that now. I know that the Linux Foundation. They have a queue of hundreds and hundreds of companies that they are vetting into the process.

Mark Weatherford, head of cybersecurity policy, Nvidia, Open Source Summit Europe, Prague

He said success depends on the people who actually take part, and he conceded that a company can always decide that sharing with a rival is a bad trade. The website he was asked about listed more than 100 leading tech firms, a public roll that is smaller than the Linux Foundation’s October 7 count of more than 150 organisations that have joined.

The foundation used the same Prague session to say the alliance’s first project, the Shared AI Findings Exchange, or SAFE, had closed its request-for-comments round, with guidelines slated for later this month.

Onstage at Open Source Summit Europe, Mark Weatherford, head of cybersecurity policy at @nvidia shared more about the Open Secure AI Alliance, a Linux Foundation initiative to develop and share open tools, techniques, and technologies that safeguard software and AI agents.… pic.twitter.com/vmJ6hn7LF2

— The Linux Foundation (@linuxfoundation) October 7, 2026

A headcount that large is the easy proof that the club exists. The harder test is whether those guidelines make companies hand over incident traces to competitors they are still racing in the model market.

OpenAI Agents Spent a Weekend Inside Hugging Face

Nvidia announced the alliance on July 27, 14 days after Hugging Face finished reconstructing an intrusion that had run across its production systems, and six days after OpenAI’s public account of what its own models had done. The Hugging Face July incident disclosure said the campaign was unlike anything the company had handled, because it was driven end to end by an autonomous AI agent system.

Hugging Face said a malicious dataset abused two code-execution paths in its data-processing pipeline, a remote-code loader and a template injection, to run code on a worker. From there the actor reached node-level access, harvested cloud and cluster credentials, and moved laterally into several internal clusters over a weekend. Public models, datasets, Spaces, container images, and published packages were checked and found clean. A limited set of internal datasets and service credentials were not.

THE JULY INTRUSION

1. July 9, 2026: Reconstructed attacker actions begin at 02:28 UTC against Hugging Face production systems.
2. July 13, 2026: The reconstructed action log ends at 14:14 UTC, after lateral movement through internal clusters.
3. July 16, 2026: Hugging Face publishes its incident note and says it used its own AI to dissect more than 17,000 recorded events.
4. July 21, 2026: OpenAI says the incident was driven by a combination of its models, including GPT-5.6 Sol and a more capable pre-release system, during an internal cyber-capability evaluation.
5. July 27, 2026: Nvidia launches the Open Secure AI Alliance and cites the Hugging Face case as the reason defenders need open tools they can run themselves.

Hugging Face said it first tried frontier models behind commercial APIs to read the attacker log, and those requests were blocked because the providers’ guardrails could not tell an incident responder from an attacker. It ran the open-weight GLM 5.2 model on its own machines instead, so that exploit payloads and stolen credentials never left its network. Nvidia’s launch post used that episode as the founding argument: when closed tools refuse the work, defenders need a model they can inspect and run locally.

What the Alliance Has Put in the Open

Nvidia’s July 27 post named more than 120 inaugural partners, a list that already included Amazon, Microsoft, Mistral, Palantir, Hugging Face, UiPath, Adobe, Dell, and the Linux Foundation. It framed the work as an open defense stack for agents, covering identity, permissions, isolation, guardrails, logs, model formats, multi-model scanning, and secure coding, rather than a fight over whether weights should be published.

MEMBER TOOLS NAMED AT LAUNCH

• NOOA: Nvidia is contributing the NVIDIA Labs Object-Oriented Agent research framework on GitHub so harnesses can test, trace, audit, and govern agent behavior.
• Safetensors: Hugging Face offered its safe weight format, which is designed to block remote code execution, to the PyTorch Foundation.
• SPIFFE/SPIRE: HPE is putting its zero-trust identity work toward cryptographic checks that only authorized agent workloads can talk to enterprise resources.
• Lightwell: IBM and Red Hat are extending digitally signed patches across the open-source supply chain.
• MDASH: Microsoft is contributing a multi-model scanning harness that sends specialized agents to find, debate, and prove exploitable bugs.
• Grok Build: SpaceXAI open-sourced a terminal coding agent and said it plans to open the Grok line’s weights.

Nvidia’s post also made a direct ask of governments: treat open models, harnesses, and security tooling as defensive assets, and do not write blanket bans that leave protection inside a few closed providers. That is the policy sentence the Prague remarks later spelled out in plainer language.

The Linux Foundation Now Holds the Membership Stamp

By September the founding company was no longer the host. The Linux Foundation moved the alliance into the Linux Foundation as a neutral home, and it used the Prague summit to put Weatherford on stage. Jim Zemlin, the foundation’s chief executive, presented the shift as a place where industry, researchers, and governments can share tools without one vendor owning the stack.

AI systems should be secure, reliable and predictable. By bringing the Open Secure AI Alliance to the Linux Foundation, we are creating a neutral home where industry, researchers and governments can collaborate on open tools, shared standards and evidence-based practices that strengthen security and support AI innovation.

Jim Zemlin, CEO, Linux Foundation, September 14, 2026 announcement

Justin Boitano, Nvidia’s vice president of enterprise AI, said on the same announcement that security improves when organisations openly share what they learn. SAFE is the vehicle for that sharing. The August RFC, drafted with Cisco, CrowdStrike, Hugging Face, Nvidia, Red Hat, and other members, proposed confidential reporting of incidents and near misses, notice to affected parties, and controls built from repeated failures rather than from blame. Comments were due by September 21. On October 7 the foundation said that round was over.

Neutral hosting does not mean an open door. Weatherford’s Prague answer put the Linux Foundation in the role of screener, not just convener, and he treated a rejected application as a feature of the process.

Closed Labs Got a White House Handshake

The alliance sits next to a separate federal track that never required a Linux Foundation vote. On June 2, President Donald Trump signed Executive Order 14409, which told Treasury, the NSA, and CISA to design a voluntary framework for covered frontier models, including government access for up to 30 days before a developer releases such a model to other trusted partners. The same section says it does not authorize a mandatory license, preclearance, or permit for publishing new models.

Weatherford’s Prague comments put Nvidia on both sides of that split. He said there are conversations in the White House with the president, and in the legislature, about new laws that would cover closed models, open models, and open source more broadly, and that Nvidia is trying to get ahead of that talk and bring reality to it.

TWO SAFETY TRACKS, AUTUMN 2026

Nvidia is on the White House accord and inside the alliance. The four labs that dominate closed frontier systems signed the September accord that left the auditor unnamed, and they are still missing from the open-security roster Weatherford was asked about in Prague. Meta had already joined Nvidia, Microsoft, IBM, Cisco, Dell, and the Linux Foundation on an open-weights letter in the week before the alliance launched. Signing a letter about downloadable models and joining a vetted security club are different acts.

Nvidia Moved to Buy the Hub It Is Securing

The alliance’s origin story is a break-in at Hugging Face. In September, Nvidia agreed to buy Hugging Face for nearly $13 billion, a deal the companies announced on September 3. Hugging Face remains listed as a member, and its Safetensors work was one of the first artifacts the alliance pointed to. The chipmaker that convened the club now has a pending claim on the main public library of open models, datasets, and apps those members use.

Jensen Huang, Nvidia’s chief executive, said in the deal announcement that open models let startups, businesses, universities, and public institutions build on advanced systems without training every model from scratch, and that AI advances faster when people can build together. That is the same open-model case Nvidia made on July 27, when it was still a partner of Hugging Face rather than its buyer.

Handing the alliance to the Linux Foundation, a few days after that purchase was announced, is how Nvidia keeps the security project from looking like a private annex of a pending acquisition. The foundation’s stamp is also how a company, a county, or an organisation can be told it does not belong.

Weatherford Left Room to Keep Some Countries Out

Asked in Prague about firms that are not members, Weatherford did not name OpenAI. He described a filter.

“There is a certain vetting process that has to happen. There are some companies, some counties, or some organisations that you may not want to be part of this,” he said.

Whether he meant counties or countries, the sentence treats membership as a screening decision, not a mailing list. The launch roster already mixed US cloud and security vendors with European names such as Mistral, UiPath, SAP, Siemens, Nokia, and Thales, plus NAVER, SK Telecom, Samsung, and G42. The queue of hundreds still sitting with the Linux Foundation is where that screen will be applied next, including to any large lab that has applied and has not been cleared.

WHAT WE KNOW

• Joined: The Linux Foundation said on October 7 that more than 150 organisations are in the alliance.
• Public list: The site Weatherford was asked about listed more than 100 leading tech companies.
• Not listed: OpenAI, Google, Anthropic, and Meta do not appear on Nvidia’s inaugural partner list or on the website roll cited in Prague.
• SAFE: The RFC has concluded; guidelines are due later this month.

WHAT IS UNCONFIRMED

• Applications: Weatherford did not say whether OpenAI, Google, Anthropic, or Meta have asked to join and are sitting in the queue.
• The filter: The foundation has not published which companies, counties, or organisations would be refused.
• The deal: Nvidia’s Hugging Face purchase has been announced; it has not closed.

SAFE’s guidelines, when they land later this month, will show whether this club is a place that publishes reusable controls or a place that collects members. Until then the Open Secure AI Alliance is what Weatherford described in Prague: a long queue, a Linux Foundation stamp, and a rule that some names do not get in.