News chronological

The SAFE framework has no formal safe-harbor protections to shield companies that voluntarily disclose potentially damaging details about an AI incident; however, the alliance is relying on the existing cybersecurity culture of sharing threat intelligence to encourage participation.

Justin Boitano, vice president and general manager of enterprise computing at Nvidia, compares the harness—which provides visibility into everything an agent is doing—to an aircraft's flight recorder in NASA's aviation safety reporting system, allowing cybersecurity experts to better determine the necessary controls for the industry.

The proposed timeline requires members to notify affected organizations as soon as possible, submit an initial confidential report to SAFE within four business days, publish a preliminary factual report within 30 days when appropriate, and provide a remediation update within 90 days.

Members are required to preserve evidence from incidents, which includes prompts, agent traces, tool calls, identities, permissions, and credentials.

Members would agree to report incidents where an AI system accesses or exploits a third-party system without authorization, breaches confidential information, or continues probing a production target after the operator suspects the activity is unauthorized. Members would also report certain near misses.

The Shared AI Findings Exchange (SAFE) is a proposed incident-reporting framework for cyber incidents involving AI agents. It is being developed by the Open Secure AI Alliance, a coalition of more than 120 organizations including Nvidia, Cisco, and CrowdStrike.