Open Secure AI Alliance: Forging the Open Defense Stack for the Agentic AI Era + Video

By /

Listen to this Post

Featured Image

Introduction:

As AI systems evolve from passive chatbots to autonomous agents capable of executing complex workflows across enterprise environments, the attack surface has expanded dramatically. The Open Secure AI Alliance (OSAA)—launched in July 2026 with over 37 founding members including NVIDIA, Microsoft, IBM, CrowdStrike, and Databricks—represents the industry’s first coordinated effort to build an open, inspectable security stack for AI agents. Databricks has joined as an inaugural member, contributing governed data capabilities, open red-teaming tooling, and a vendor-agnostic AI security framework that maps 55 distinct risks to actionable controls.

Learning Objectives:

  • Understand the architectural components of the open defense stack for agentic AI systems
  • Master the deployment and usage of BlackIce, Databricks’ containerized AI red-teaming toolkit
  • Implement zero-trust identity frameworks (SPIFFE/SPIRE) for AI agent verification
  • Learn to detect and mitigate model supply chain attacks, including pickle-based RCE vectors
  • Apply the Databricks AI Security Framework (DASF) to assess and harden AI deployments

You Should Know:

1. The Open Defense Stack: Beyond Model Weights

An AI agent is not merely a model—it is a complex system comprising models, harnesses, guardrails, identity controls, and governance layers. The OSAA’s core premise is that security intelligence locked inside closed systems leaves the broader ecosystem exposed. The alliance’s technical scope covers the full infrastructure surrounding agents: identity, permissions, isolation, harnesses, guardrails, logs, and evaluation systems.

Step-by-Step Guide: Understanding the OSAA Technical Architecture

  1. Identity Layer: HPE’s contribution advances SPIFFE/SPIRE—zero-trust identity standards that cryptographically verify AI agents before they interact with enterprise resources. SPIFFE defines open standards for authenticating software services through platform-independent cryptographic identities, while SPIRE implements these standards across Kubernetes, AWS, Azure, and GCP environments.

  2. Model Format Layer: Hugging Face’s Safetensors provides a safer model-weight format that prevents remote code execution (RCE) during deserialization, addressing the critical vulnerability where PyTorch’s `torch.load()` with pickle enables arbitrary code execution.

  3. Scanning Harness Layer: Microsoft’s MDASH is a multi-model, agentic scanning harness that uses specialized agents to discover, debate, and prove the existence of exploitable bugs—moving beyond single opaque scanners.

  4. Governance Layer: Databricks contributes DASF 3.0 (Databricks AI Security Framework), a vendor-agnostic framework mapping 55 security risks across the AI system lifecycle to specific controls.

2. BlackIce: The Kali Linux for AI Security

Databricks has released BlackIce, an open-source containerized red-teaming toolkit that bundles 14 widely used AI security tools into a single, reproducible Docker environment. Inspired by Kali Linux for traditional penetration testing, BlackIce addresses four critical pain points: unique tool configurations, dependency conflicts, notebook environment limitations, and the overwhelming tool landscape.

Step-by-Step Guide: Deploying and Using BlackIce

1. Pull the BlackIce Docker Image:

docker pull databricks/blackice:latest

2. Run the Container Interactively:

docker run -it --rm databricks/blackice:latest /bin/bash

3. List Available Tools:

blackice --list-tools

The toolkit includes: LM Eval Harness (10.3K stars), Promptfoo (8.6K), CleverHans (6.4K), Garak (6.1K), ART (5.6K), Giskard (4.9K), CyberSecEval (3.8K), PyRIT (2.9K), and others.

  1. Run a Prompt Injection Test Against an LLM: 
    blackice run promptfoo --target https://your-llm-endpoint --prompts injection_prompts.txt

    This maps to MITRE ATLAS AML.T0051 (LLM Prompt Injection) and DASF control 9.1.

  2. Scan a Model File for Supply Chain Vulnerabilities:

    blackice run fickling --scan model.pth

    Fickling detects malicious pickle-based serialization—a critical check given that PyTorch’s `weights_only=True` safety mechanism can be bypassed, enabling heap buffer overflow even when best practices are followed.

6. Generate Adversarial Examples for Computer Vision Models:

blackice run cleverhans --attack fgsm --model resnet50 --input image.jpg

This maps to MITRE ATLAS AML.T0015 (Evade ML Model).

7. Test for LLM Data Leakage:

blackice run pyrit --leakage-test --prompt "What was your training data?"

Maps to MITRE ATLAS AML.T0057 (LLM Data Leakage) and DASF 10.6.

BlackIce’s architecture separates static tools (installed in isolated Python virtual environments or Node.js projects) from dynamic tools (installed in the global Python environment with managed global_requirements.txt), effectively solving dependency hell.

3. Securing the AI Model Supply Chain

The AI supply chain has become a primary attack vector. In 2024 alone, JFrog discovered roughly 100 malicious model files on Hugging Face, with approximately 95% targeting PyTorch’s pickle-based serialization. The TeamPCP threat group executed a cascading supply chain campaign in March 2026 that compromised the Trivy security scanner and aggregated API credentials for over 100 LLM providers including OpenAI and Anthropic.

Step-by-Step Guide: Model Supply Chain Hardening

1. Enforce SafeTensors Format:

 Instead of torch.load('model.pt')
from safetensors.torch import load_file
model = load_file('model.safetensors')

SafeTensors prevents arbitrary code execution during deserialization.

2. Implement Model SBOM (Software Bill of Materials):

 Using Syft to generate SBOM for ML models
syft dir:./models -o json > model_sbom.json

3. Scan for Malicious Pickle Files:

 Using Fickling from BlackIce
blackice run fickling --scan --recursive ./models/

4. Verify Model Signatures:

 Using Sigstore for cryptographic verification
cosign verify-blob --key cosign.pub model.safetensors

5. Apply Least Privilege for Model Loading:

import torch
 Enable restricted unpickler
torch.serialization.add_safe_globals([list, dict])
model = torch.load('model.pt', weights_only=True, pickle_module=restricted_unpickler)

4. Zero-Trust Identity for AI Agents

SPIFFE/SPIRE provides the foundation for cryptographic identity verification of AI agents across multi-cloud environments. This is critical because autonomous agents can execute actions across multiple systems—without proper identity verification, a compromised agent becomes a pivot point for lateral movement.

Step-by-Step Guide: Implementing SPIFFE/SPIRE for AI Agents

1. Deploy SPIRE Server:

helm install spire spire/spire --1amespace spire --create-1amespace

2. Register an AI Agent Workload:

spire-server entry create \
-spiffeID spiffe://example.org/ai-agent/chatbot \
-parentID spiffe://example.org/workload-1ode \
-selector k8s:pod-label:app:chatbot-agent

3. Verify Agent Identity:

spire-agent api fetch jwt -audience https://api.internal

4. Integrate with Istio for Service Mesh Security:

apiVersion: security.istio.io/v1beta1
kind: AuthorizationPolicy
metadata:
name: ai-agent-policy
spec:
selector:
matchLabels:
app: ai-agent
rules:
- from:
- source:
principals: ["spiffe://example.org/ai-agent/"]

5. Implement Workload Isolation:

 Using gVisor for container isolation
docker run --runtime=runsc databricks/blackice:latest

5. Agentic AI Threat Modeling and Mitigation

The OWASP Top 10 for LLMs has expanded to include agentic AI-specific threats: prompt injection, tool misuse, and unintended actions across AI workflows. CISA and international partners have released guidance emphasizing least privilege, scope limitation, and temporary credentials.

Step-by-Step Guide: Agentic AI Security Hardening

1. Implement Input Sanitization:

from transformers import pipeline
def sanitize_prompt(prompt):
 Block system prompt override attempts
if "system:" in prompt.lower() or "instruction:" in prompt.lower():
raise ValueError("System prompt injection detected")
return prompt

2. Enforce Tool Authorization Policies:

ALLOWED_TOOLS = ["read_logs", "query_database", "send_email"]
def authorize_tool(agent_id, tool_name, resource):
 Check against policy engine (OPA)
return opa.query(f"data.auth.allow('{agent_id}', '{tool_name}', '{resource}')")

3. Implement Execution Sandboxing:

 Firejail for Linux process isolation
firejail --1et=eth0 --private=/tmp/sandbox python agent.py

4. Deploy Behavioral Auditing:

import logging
audit_logger = logging.getLogger("agent_audit")
def audit_action(agent, action, params, result):
audit_logger.info({
"agent_id": agent.id,
"action": action,
"params": params,
"result": result,
"timestamp": datetime.utcnow().isoformat()
})

5. Use Temporary Credentials:

 AWS STS for temporary credentials
aws sts assume-role --role-arn arn:aws:iam::account:role/agent-role \
--role-session-1ame agent-session-$(uuidgen)
  1. Lakewatch: Open Security Lakehouse for Agentic Threat Detection

Databricks’ Lakewatch provides an open, governed Security Lakehouse architecture for agentic threat detection and response at scale, enabling unlimited unified data and petabyte-scale threat detection with up to 80% lower TCO.

Step-by-Step Guide: Deploying Lakewatch for Agent Monitoring

1. Configure Data Ingestion:

CREATE TABLE agent_audit_logs
USING delta
LOCATION '/mnt/lakewatch/agent_logs'
AS SELECT  FROM raw_agent_events

2. Define Detection Rules:

CREATE DETECTION_RULE anomalous_tool_usage
AS SELECT agent_id, tool_name, COUNT() as usage_count
FROM agent_audit_logs
WHERE timestamp > now() - INTERVAL 1 HOUR
GROUP BY agent_id, tool_name
HAVING usage_count > (SELECT AVG(usage_count)  3 FROM historical_agent_usage)

3. Set Up Automated Response:

 Databricks Workflow for incident response
def respond_to_threat(alert):
if alert.severity == "CRITICAL":
revoke_agent_credentials(alert.agent_id)
isolate_workload(alert.agent_id)
notify_security_team(alert)

What Undercode Say:

  • Open security is not optional—it’s existential. The Hugging Face incident demonstrated that closed AI tools can block forensic analysis during active breaches, leaving defenders blind. The OSAA’s commitment to open models, harnesses, and tooling ensures that any organization can inspect, adapt, and run defenses on infrastructure they control.

  • The agent stack is the new attack surface. Models are just one layer. The OSAA’s focus on identity, permissions, isolation, harnesses, guardrails, logs, and evaluation systems correctly recognizes that security must be baked into every component of the agentic architecture.

  • Tool fragmentation kills security velocity. BlackIce’s containerized approach mirrors the success of Kali Linux—by eliminating setup friction, security teams can focus on finding vulnerabilities rather than wrestling with dependency conflicts. The integration of 14 tools mapped to MITRE ATLAS and DASF provides a unified workflow for AI red teaming.

  • Supply chain attacks are the silent killer. With 95% of malicious Hugging Face models targeting PyTorch and the weights_only=True bypass enabling RCE even with best practices, organizations must implement SafeTensors, model SBOMs, and cryptographic verification immediately.

  • Zero-trust identity for agents is non-1egotiable. SPIFFE/SPIRE provides the cryptographic foundation for verifying AI agents before they access enterprise resources. As agents become more autonomous, the ability to authenticate and authorize every action becomes the difference between controlled automation and catastrophic breach.

Prediction:

  • +1 The OSAA will accelerate enterprise AI adoption by providing a standardized, inspectable security stack that reduces the risk premium currently slowing production deployments. The alliance’s open approach will likely become the de facto security standard for agentic AI within 18-24 months.

  • +1 BlackIce and similar toolkits will democratize AI security testing, enabling organizations of all sizes to conduct red-team exercises that were previously accessible only to well-funded security teams. This will drive a new wave of AI vulnerability discoveries and faster patching cycles.

  • -1 The absence of major AI labs like OpenAI, Anthropic, and Google from the OSAA creates a fragmented security landscape where the most widely used frontier models may not adopt open security standards, potentially leaving a large attack surface unaddressed.

  • +1 SPIFFE/SPIRE integration with AI agent frameworks will enable fine-grained, cryptographically verified authorization policies that prevent lateral movement even when individual agents are compromised—fundamentally changing the economics of AI-targeted attacks.

  • -1 The AI supply chain will see an escalation of attacks as threat actors shift focus from traditional software to model files. The pickle deserialization vulnerability—estimated to affect over 60% of models on Hugging Face—will be exploited at scale before the ecosystem fully migrates to SafeTensors.

  • +1 Lakewatch’s open Security Lakehouse architecture will enable security teams to correlate agent activity with network, endpoint, and identity data in a unified data plane, dramatically reducing mean time to detection (MTTD) for AI-related incidents.

  • -1 Organizations that delay implementing the OSAA’s open defense stack will face increasing regulatory and insurance pressures, potentially creating a two-tier AI security landscape where only enterprises with mature open security practices can deploy high-risk agentic AI systems.

▶️ Related Video (80% Match):

https://www.youtube.com/watch?v=47mW87Czq90

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Erez Etzyon – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Related Posts: