News chronological

Security leaders are facing decision fatigue due to an increasingly complex security and regulatory landscape, the need to define AI governance strategies (including what constitutes AI risk and responsible deployment), and a constant loop of education and research as new capabilities emerge from frontier and open-weight model maintainers.

The release of open-weight models such as Kimi K3 and GLM-5.2 has raised these fears.

Companies are grappling with questions regarding agent permissions, identity, logging, and accountability.

Companies should double down on fundamentals, including threat detection, incident response, security assessments, and remediation.

The SAFE framework has no formal safe-harbor protections to shield companies that voluntarily disclose potentially damaging details about an AI incident; however, the alliance is relying on the existing cybersecurity culture of sharing threat intelligence to encourage participation.

Justin Boitano, vice president and general manager of enterprise computing at Nvidia, compares the harness—which provides visibility into everything an agent is doing—to an aircraft's flight recorder in NASA's aviation safety reporting system, allowing cybersecurity experts to better determine the necessary controls for the industry.

The proposed timeline requires members to notify affected organizations as soon as possible, submit an initial confidential report to SAFE within four business days, publish a preliminary factual report within 30 days when appropriate, and provide a remediation update within 90 days.

Members are required to preserve evidence from incidents, which includes prompts, agent traces, tool calls, identities, permissions, and credentials.