--- title: What is the Open Secure AI Alliance and why are... description: NVIDIA launched the Open Secure AI Alliance with 75+ founding members including Databricks, Docker, and Trend Micro, focused on building security, governance,... canonical: https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What is the Open Secure AI Alliance and why are companies joining it | daily.dev og:description: NVIDIA launched the Open Secure AI Alliance with 75+ founding members including Databricks, Docker, and Trend Micro, focused on building security, governance,... og:url: https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i og:image: https://api.daily.dev/og/posts/wYCz8Ur4I.png og:image:alt: What is the Open Secure AI Alliance and why are companies joining it og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What is the Open Secure AI Alliance and why are companies joining it **[Collections](https://daily.dev/sources/collections)** · 4 min read · 1 upvotes · 0 comments ## Summary NVIDIA launched the Open Secure AI Alliance with 75+ founding members including Databricks, Docker, and Trend Micro, focused on building security, governance, and trust frameworks for agentic AI systems. Key contributions include Databricks' open-source tools (Omnigent meta-harness, DASF 3.0 risk catalog with 97 threats and 73 mitigations, BlackIce red-teaming toolkit, and Lakewatch threat detection platform), Docker's runtime trust layer work, and Trend Micro's integration of governance policies into NVIDIA's OpenShell runtime. The alliance emphasizes open models and sovereign/private cloud deployments for regulated industries. The core argument: agentic AI has a much larger security surface than chatbots, and defenders need access to the same frontier capabilities as attackers. Whether the coalition produces durable interoperable standards or remains a press release is the key question to watch. ## Content ## What is the Open Secure AI Alliance? NVIDIA's Open Secure AI Alliance is a coalition of companies focused on building security, governance, and trust infrastructure for agentic AI systems. The founding premise is straightforward: as AI agents gain access to private data, external tools, and outbound communication channels, the attack surface grows well beyond the model itself. The runtime environment, identity systems, and governance layers all need to be secured too. The alliance operates across four pillars: open models, open harnesses, open skills, and open research. A recurring argument from members is that defenders need the same access to frontier AI capabilities as attackers already have — and that open systems are the only way to guarantee that parity. --- ## Who's joined so far **Mistral AI** contributed Shieldstral, a 3B open-weights multimodal safety classifier released under Apache 2.0. Unlike traditional guard models with fixed harm taxonomies, Shieldstral frames content moderation as binary question-answering: you supply a plain-language policy question at inference time and get a calibrated yes/no probability score. This means you can adapt it to new policies without retraining. The model handles text, images, and text+image pairs, runs on a single 16GB GPU, and reportedly matches or outperforms open guard models up to 7x its size. Training innovations include unifying heterogeneous safety datasets into one format, generating contrastive policy pairs to teach discrimination rather than memorization, augmenting scarce visual safety data with general-purpose image datasets, and merging LoRA-fine-tuned checkpoints via SLERP. **Databricks** joined as a founding member and brought several open-source tools: - **Omnigent** — an open-source meta-harness for governing AI agents with contextual policies and sandbox isolation - **DASF 3.0** — a catalog of 97 security risks and 73 mitigations for AI systems, including agentic threats - **DAGF** — a governance framework covering accountability and risk management - **BlackIce** — a containerized red-teaming toolkit bundling 14 AI security tools - **Lakewatch** — an open Security Lakehouse for agentic threat detection at scale, built on Unity Catalog (Apache 2.0, donated to the Linux Foundation) **Docker** joined with a focus on runtime trust. Docker's CEO noted that customer conversations have shifted from "what can AI do" to "can we trust it." Their argument is that trust in agentic AI has to extend to the containers and runtime environments wrapping the model, not just the model weights themselves. Docker also flagged that customers increasingly rely on open-weight models and need the flexibility to switch between them without rebuilding their security posture from scratch. **Trend Micro's TrendAI** joined as an inaugural partner, contributing integrations like TrendAI Vision One governance policies within NVIDIA's OpenShell runtime. They also cited their Zero Day Initiative as evidence that shared research accelerates vulnerability discovery and patching. Trend Micro specifically highlighted the alliance's support for sovereign and private cloud deployments — relevant for regulated industries where data can't leave controlled environments. The alliance now has 75+ member organizations. --- ## The "lethal trifecta" problem Omnigent is trying to solve One of the more concrete technical contributions from Databricks is Omnigent's contextual policy system, which targets what they call the "lethal trifecta": the dangerous combination of private data access, untrusted content exposure, and an outbound communication channel. Here's why this matters. Standard per-action authorization checks approve each capability individually — reading a file is fine, sending an email is fine. But an attacker who can inject instructions into content the agent reads can chain those individually-approved actions into a data exfiltration attack. A concrete example: a support-ticket agent reads internal Q3 revenue figures (private data), then processes a ticket containing a prompt injection (untrusted content), then sends an email to an attacker-controlled address (outbound channel). Each step looks legitimate in isolation. Omnigent's contextual policies track session state across all three legs. The outbound action is only blocked when both prerequisite legs — private data read and untrusted content ingested — are already active in the same session. Normal work, like a password-reset ticket that never touches sensitive data, goes through unaffected. Importantly, tool classifications are set by humans in the agent config, not by the agent itself. This prevents prompt injection from reclassifying a sensitive resource as safe. The approach also extends to multi-agent systems by treating sub-agent instructions as untrusted content by default. Omnigent is open source and currently in alpha. --- ## The broader argument The through-line across all these announcements is that securing agentic AI requires more than model-level safety filters. The harness — the scaffolding of runtimes, policies, identity systems, and governance layers around the model — is where a lot of the real risk lives. The alliance's bet is that open systems, shared research, and standardized frameworks are the fastest path to getting that infrastructure right. ## Questions this post answers ### What is the lethal trifecta in AI agent security and how does Omnigent defend against it? The lethal trifecta is the combination of private data access, untrusted content exposure, and an outbound communication channel in an AI agent session, which lets an attacker chain individually-approved actions into a data exfiltration attack. Databricks' open-source Omnigent addresses this by tracking session state across all three legs and only blocking outbound actions when both prerequisite legs are already active, while leaving normal workflows unaffected. _Teams securing agentic AI pipelines can follow emerging defenses like this via daily.dev._ ### What is Shieldstral and how is it different from typical AI guard models? Shieldstral is a 3B-parameter open-weights multimodal safety classifier from Mistral AI, released under Apache 2.0, that frames content moderation as binary question-answering instead of using a fixed harm taxonomy. A plain-language policy question is supplied at inference time to get a calibrated yes/no probability, letting it adapt to new policies without retraining; it handles text, images, and text+image pairs on a single 16GB GPU and reportedly matches or beats guard models up to 7x larger. _Developers evaluating lightweight safety classifiers can track releases like Shieldstral on daily.dev._ ### What is the Open Secure AI Alliance and which companies have joined it? It is a coalition led by NVIDIA focused on building security, governance, and trust infrastructure for agentic AI systems, organized around open models, open harnesses, open skills, and open research. Founding and inaugural members include Mistral AI, Databricks, Docker, and Trend Micro, with the alliance now counting more than 75 member organizations. _Anyone weighing which vendors to trust for agentic AI security can follow this alliance's progress on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 38 comments across hackernews (as of 2026-09-13). **TL;DR:** The community is cautiously interested in Shieldstral's policy-adaptive approach and small footprint, but skeptical about Mistral's competitive position and whether a black-box AI moderator can truly replace human judgment or satisfy real-world regulatory requirements. **Sentiment:** 30% positive · 45% mixed · 25% skeptical **The case for** - The binary question-answering framing makes it genuinely policy-flexible without retraining, which commenters find technically interesting. - Its small size and single-GPU footprint make it a realistic, cost-effective option for indie developers building content platforms. - Releasing under Apache 2.0 fits well with enterprise on-premise deployments where sending data off-site is a concern. **The pushback** - Skepticism that a black-box model can match human moderators who exercise genuine contextual discretion. - Concerns about whether AI-based moderation satisfies liability and regulatory requirements compared to human moderator teams. - Some view the release as a sign Mistral lacks the compute and funding to compete at the frontier, leaving them relegated to niche utility models. - Doubts about how truly flexible the policy-question interface is in practice versus just toggling a few preset harm categories. **By community** - hackernews (mixed): Developers appreciate the adaptive moderation concept and small-model practicality, but debate Mistral's strategic position, the limits of AI moderation versus human discretion, and whether the model is as policy-flexible as claimed. **Hottest debate:** Whether AI-driven moderation with a flexible policy interface can genuinely replace human moderators with real discretion, or merely automates a fixed rules engine under a different guise. **Open questions** - How truly flexible is the policy-question space — can it handle nuanced, non-standard harm definitions beyond common categories like sex and violence? - Would deploying this model satisfy legal liability requirements under regulations like the EU AI Act compared to a human moderation team? - How reliable is the model on real-world edge cases where malicious intent is wrapped in polite language? **Highlights** > I would be curious if this can do moderation with an arbitrary ruleset, or if it's just "that one moderation style" we already know from current big tech platforms. The kind where malicious intent is okay if the words are nice. ___ Or, rephrased: How big is the space in which you can tune this model without retraining. Is it just "we hate sex"/"we don't hate sex" "We hate violence"/"we don't hate violence" or is it _truly_ as flexible as claimed? __ Maybe something like "Is this guy a corporate fraud that is going to waste my time with performative nonsense?" That would be the true test for a moderation model and I would be immensely impressed if it could manage to pull that off. > — [hypfer on hackernews](https://news.ycombinator.com/item?id=49173851) > I'm a bit doubtful that a black box approach like this to moderation will ever catch on. > — [elianaive on hackernews](https://news.ycombinator.com/item?id=49174135) > I've had dreams of building something in the image sharing or social platform realm, but stopped short of planning because of obvious content moderation responsibilities. This seems to be a realistic, cost effective solution to that one piece of the puzzle. > — [pwython on hackernews · 1 comments](https://news.ycombinator.com/item?id=49174594) > It's not that their strategy is to train smaller models, it's the only choice they have. Training SOTA takes anywhere from 1.5b to 150b. We don't know the real cost of training for the chinese models, but mistral neither has the compute nor money to do that. > — [himata4113 on hackernews](https://news.ycombinator.com/item?id=49174292) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=49171268) · 110 points · 38 comments --- Tags: [#open-source](https://daily.dev/tags/open-source), [#nvidia](https://daily.dev/tags/nvidia), [#ai-security](https://daily.dev/tags/ai-security), [#agentic-ai](https://daily.dev/tags/agentic-ai), [#ai-governance](https://daily.dev/tags/ai-governance) [View this post on daily.dev](https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What is the Open Secure AI Alliance and why are companies joining it","url":"https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i"},"datePublished":"2026-08-04T16:04:01.510Z","dateModified":"2026-09-13T19:43:06.067Z","description":"NVIDIA launched the Open Secure AI Alliance with 75+ founding members including Databricks, Docker, and Trend Micro, focused on building security, governance,...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1028a46bd3bba0d1aab25891755937a8?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/1028a46bd3bba0d1aab25891755937a8?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"open-source,nvidia,ai-security,agentic-ai,ai-governance","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"What is the Open Secure AI Alliance and why are companies joining it"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-is-the-open-secure-ai-alliance-and-why-are-companies-joining-it-wycz8ur4i#faq","mainEntity":[{"@type":"Question","name":"What is the lethal trifecta in AI agent security and how does Omnigent defend against it?","acceptedAnswer":{"@type":"Answer","text":"The lethal trifecta is the combination of private data access, untrusted content exposure, and an outbound communication channel in an AI agent session, which lets an attacker chain individually-approved actions into a data exfiltration attack. Databricks' open-source Omnigent addresses this by tracking session state across all three legs and only blocking outbound actions when both prerequisite legs are already active, while leaving normal workflows unaffected. Teams securing agentic AI pipelines can follow emerging defenses like this via daily.dev."}},{"@type":"Question","name":"What is Shieldstral and how is it different from typical AI guard models?","acceptedAnswer":{"@type":"Answer","text":"Shieldstral is a 3B-parameter open-weights multimodal safety classifier from Mistral AI, released under Apache 2.0, that frames content moderation as binary question-answering instead of using a fixed harm taxonomy. A plain-language policy question is supplied at inference time to get a calibrated yes/no probability, letting it adapt to new policies without retraining; it handles text, images, and text+image pairs on a single 16GB GPU and reportedly matches or beats guard models up to 7x larger. Developers evaluating lightweight safety classifiers can track releases like Shieldstral on daily.dev."}},{"@type":"Question","name":"What is the Open Secure AI Alliance and which companies have joined it?","acceptedAnswer":{"@type":"Answer","text":"It is a coalition led by NVIDIA focused on building security, governance, and trust infrastructure for agentic AI systems, organized around open models, open harnesses, open skills, and open research. Founding and inaugural members include Mistral AI, Databricks, Docker, and Trend Micro, with the alliance now counting more than 75 member organizations. Anyone weighing which vendors to trust for agentic AI security can follow this alliance's progress on daily.dev."}}]} ```