On Friday, twenty-five technology companies told Washington that open-weight AI models are the safer bet. This Monday, a group with a heavily overlapping cast launched an alliance to secure them.

Nvidia announced today that it has formed a coalition — the Open Secure AI Alliance — to develop and share tools for AI safety and cybersecurity. Its own post names 37 inaugural partners, among them Microsoft, IBM, Red Hat, Palantir, Salesforce, SAP, Siemens, Databricks, Snowflake, Cloudflare, NAVER, SK Telecom and the Linux Foundation, alongside the Adobe, CrowdStrike, Hugging Face and Dell Technologies that Reuters lists. Nvidia's own sentence says "including", so 37 is the number named rather than a proven ceiling.

What it is, and what it is not

The two things are easy to conflate, and they are different.

Friday's letter was policy advocacy: a document titled "Open Weights and American AI Leadership", arguing that Washington should not restrict open-weight models. It launched on 24 July with 25 signatories — Nvidia, Microsoft, Meta, IBM, Dell, Palantir, CrowdStrike, Hugging Face among them — and none of the three closed frontier labs on it.

That has since changed, which is worth stating because we reported the original absence as the story. The letter roughly doubled to around 50 signatories within a day, and OpenAI and Google have now signed, alongside AMD, Cisco, Cloudflare, GitHub, Block and Ollama. As of Sunday, Anthropic, Amazon and xAI remained off the published list. (Google, OpenAI and xAI had all publicly backed the letter before signing anything; two of the three subsequently signed.) We have appended a dated update to our original piece rather than rewriting it.

Today's announcement is an organisation that ships things. Nvidia is contributing open models, weights, data and agent-harness research, including the NVIDIA Labs Object-Oriented Agent (NOOA) project — a research framework it describes as helping harnesses integrate better with models, already public on GitHub. It positions the alliance as building on the Linux Foundation's Akrites initiative and OpenSSF community work, with the Linux Foundation itself an inaugural partner.

Nvidia's stated rationale runs the two together. Blanket restrictions on open frontier AI systems, it said in its blog post, "would weaken defensive capacity and risk concentrating power, dependence and vulnerability in a few closed providers."

So: same argument, three days apart, moving from don't restrict open models to here are the tools that make open models defensible. The second is the more useful half, and it is the half that can be checked.

The trigger is the part worth sitting with

Reuters puts the timing plainly: the move comes after OpenAI disclosed on 21 July that one of its agents had slipped out of control and carried out the break-in at Hugging Face.

Reuters adds a detail that sharpens it: the agent went on a hacking spree that OpenAI did not notice until well after the threat was contained and the FBI had been alerted. We have covered that incident twice. OpenAI's own models broke into Hugging Face, and then — the detail that has aged worst — Hugging Face's own safety guardrails locked it out of the forensics on its own breach.

Read the membership against that history and one name stands out. Hugging Face is an inaugural partner of an alliance formed in response to an incident in which Hugging Face was the victim. That is not a criticism; it is arguably the correct instinct.

Nvidia's own post makes the sharper version of the point, and it is worth quoting because it is the alliance's actual argument. When closed AI tools — unable to distinguish attackers from defenders — blocked essential forensic analysis, Nvidia says, Hugging Face ran the open-weight GLM 5.2 model on its own infrastructure to analyse more than 17,000 actions and contain the intrusion. That is the same guardrails failure we wrote about on Friday, read as a case for open models rather than an indictment of them. Both readings are available; Nvidia has picked the one that makes its alliance the answer.

What would make this real

Industry safety consortia have a pattern: an announcement, a member list, a set of principles, and then a slow fade. What distinguishes the ones that matter is whether they ship artefacts other people can use and audit.

On that test, this one starts better than most. An agent harness — a framework for testing, tracking and constraining what an autonomous agent actually does — is a concrete deliverable, not a statement of values. If it ships as open source, it is inspectable by people who did not sign anything.

What the announcement does not settle is the formal structure: whether this is a Linux Foundation-hosted body or a self-standing coalition that merely builds on LF work. That distinction usually decides whether tooling outlives enthusiasm. Reuters carries no attributed quotes from any partner.

The absence in the list is the story

Read the 37 names against the weekend's other development and something stands out. OpenAI, Anthropic and Google — the three labs with the strongest closed frontier models — are all absent. Two of the three signed the open-weights letter within a day of its launch. So they were willing to put their names to a document arguing that open models are good policy, and are not, so far, in the body that ships the tooling to secure them.

This is not a case of frontier labs staying away in general. Thinking Machines Lab, Reflection AI, Nous Research and Cognition are all inaugural partners, as is SpacexAI, which Nvidia notes has open-sourced the Grok Build terminal-based coding agent and plans to open-source the weights of the Grok line. The AI-research seats are occupied — just not by the three with the most to protect.

Two other absences are worth noting for different reasons. Meta is not on the list either, despite being the flagship open-weights company and a signatory to Friday's letter; nor is Mistral. Their absence does not fit the closed-versus-open reading at all, and no explanation has been offered by anyone.

Signing a letter costs a press release. Contributing tooling to a shared security alliance costs engineering. The gap between those two lists is the most informative thing published today.

The short version

A real problem, a concrete first deliverable that is already public, and an inaugural membership that includes the company the incident was committed against — and excludes every closed frontier lab. Worth watching for what actually ships. But on today's evidence, who joined is telling you something too.