On July 27, 2026, Nvidia and roughly three dozen partners announced the Open Secure AI Alliance, a working group meant to give security teams open, inspectable tools for AI agent security rather than relying on whatever each model vendor ships. Two weeks later the group had already tripled in size. By August 11 it had crossed 120 member companies, including Adobe, BlackRock, Cisco, Intel, Microsoft, and Visa. That growth rate says something the press releases don’t: enterprises are more worried about agent security than any single vendor’s roadmap has acknowledged.
From 37 founders to 120 members in two weeks
The alliance launched with an initial group of roughly 37 to 40 founding partners, already a wide spread across cloud providers, security vendors, and enterprise software companies. Within days it had absorbed names like Amazon, Okta, Red Hat, Hugging Face, and the Linux Foundation, and by early August it had passed 120 members. That pace of adoption for an industry consortium is unusual — most security standards bodies take years to reach that kind of membership, not weeks.
The alliance’s technical output so far centers on a working group called the Shared AI Findings Exchange, or SAFE, which proposes a way for member companies to confidentially report AI-agent security incidents and near-misses, then run blame-free analysis to spot recurring control failures. Contributions committed so far include Nvidia’s open-source Garak vulnerability scanner, Okta’s agent identity work, Red Hat’s agent governance tooling, and Amazon’s Strands Agents framework with its Cedar authorization language.
Anthropic, OpenAI, and Google are not in the room
The absence is deliberate framing by nearly every outlet that covered the launch, and it’s a fair point. Anthropic, OpenAI, and Google build the frontier models that power most of the agents this alliance is trying to secure, and none of the three has joined. Exabeam CISO Kevin Kirkwood put it directly: “the major frontier model developers need to be at the table, and the industry needs agreed rules for liability when an agent exceeds scope.”
An alliance built mostly from infrastructure, security, and enterprise software vendors can standardize identity, permissions, and logging around agents. It can’t set the guardrails inside the models those agents run on. That split matters for anyone deciding which security controls to trust and which ones to build in-house.
Why AI agent security incidents are already common
The alliance didn’t form in a vacuum. A VentureBeat enterprise survey found that 88% of enterprises reported a confirmed or suspected AI-agent security incident in the past year, while 82% of executives still believe their existing policies protect them from unauthorized agent actions. Only 21% have real runtime visibility into what their agents are actually doing.
A related finding from the same research is more specific about where the gap sits: 65% of enterprises enforce scoped runtime permissions and 56% log agent activity, but only 18% isolate their highest-risk agents. Teams have built partial controls. Containment, the part that stops a compromised agent from doing real damage, is still rare.
Meta’s Muse Code widens the surface this alliance is chasing
The timing lines up with another shift in the same two weeks. Meta released Muse Code, a terminal-based coding agent, in beta on August 5, built on its updated Muse Spark foundation model. Muse Code runs persistent background agents that hold context across an entire session instead of restarting on every task, and it can coordinate subagents on larger engineering jobs.
That architecture is exactly the kind of standing, tool-calling agent behavior the alliance’s stated scope — identity, permissions, isolation, guardrails, and secure coding workflows — is meant to cover. Muse Code turns what had been a two-vendor race between Anthropic and OpenAI coding agents into a three-way contest, which is good for pricing and iteration speed. It also means a third vendor’s agent now has standing repo access, session memory, and subagent orchestration running inside enterprise codebases, with its own credential and isolation model to evaluate.
What engineering teams should do about agent security now
None of this requires waiting for the alliance to publish a finished spec. Three things are already actionable for teams running agentic coding tools at scale:
- Treat every coding agent — whether it’s Muse Code, Claude Code, or Codex — as a credentialed identity with its own scoped permissions, not a shared service account, since credential sharing is one of the clearest gaps the VentureBeat data points to.
- Close the gap between enforcement and isolation: scoped permissions and logging are table stakes, but if a compromised or misbehaving agent can still reach production data or other systems, the control isn’t finished.
- Track which vendors join the Open Secure AI Alliance and which don’t, since membership is a rough proxy for whether a vendor will expose the identity and permission hooks your security team needs, independent of that vendor’s own dashboard.
The Open Secure AI Alliance’s fast growth shows enterprises want shared, open defenses for agentic AI faster than any single vendor can build them alone. But a security alliance without the three labs building the most widely deployed agent models is still missing a piece of the stack it’s trying to secure. For engineering teams adopting agentic coding tools this year, the practical move isn’t waiting on a consortium spec — it’s auditing which agents already run with standing credentials in your codebase, and closing the isolation gap before an incident forces the question.