Open Secure AI Alliance: Forging The Open-Source Defense Stack For The Agentic AI Era + Video

Introduction:

As artificial intelligence systems evolve from passive question-answering tools into autonomous agents capable of orchestrating complex workflows and executing actions across enterprise environments, the cybersecurity paradigm is undergoing a seismic shift. Two critical challenges are converging: securing AI systems themselves against novel attack vectors such as goal hijacking, tool misuse, and context poisoning, while simultaneously harnessing AI to strengthen cyber defense mechanisms at scale. The Open Secure AI Alliance, launched by NVIDIA with over 75 founding members including Databricks, Microsoft, IBM, and CrowdStrike, addresses this convergence through a fundamental premise: AI safety and security research must be shared openly, and the tools produced must be built on open systems. This article explores the Alliance’s technical contributions, provides hands-on implementation guidance for security practitioners, and analyzes the strategic implications of open versus closed AI security ecosystems.

Learning Objectives:

Understand the architectural components of the agentic AI security stack and the Open Secure AI Alliance’s approach to hardening each layer.
Master practical implementation of AI security frameworks including Databricks AI Security Framework (DASF) controls, NVIDIA NOOA agent harnesses, and Hugging Face Safetensors model protection.
Acquire hands-on skills for AI red teaming, zero-trust agent identity verification, and vulnerability scanning using open-source tools contributed by Alliance members.

You Should Know:

The Agentic AI Security Stack: Beyond Model Weights

An AI agent is not merely a model; it is a complex system composed of models, harnesses, guardrails, and orchestration layers that govern what the agent is permitted to do. While significant attention has focused on securing open-weight models, model weights represent only one layer of the attack surface. Security in the agentic era demands an open execution stack encompassing the runtime environment, guardrails, the harness orchestrating agents and their tools, risk and control frameworks, and enterprise governance layers ensuring auditability and accountability.

The Open Secure AI Alliance builds upon existing work from the Linux Foundation’s Akrites initiative and the OpenSSF community to remediate and disclose vulnerabilities using open technologies. Open systems allow the broadest community of defenders to study, test, and strengthen every component of this stack, building trust on assurances, visibility, evidence, participation, and choice.

Member Contributions Across the Stack:

| Alliance Member | Contribution | Security Layer |

||||

2. Implementing Databricks AI Security Framework (DASF) Controls

The Databricks AI Security Framework (DASF) provides a structured approach to identifying and mitigating AI system risks. DASF 3.0 now covers Agentic AI as its 13th system component, adding 35 new technical security risks and 6 new mitigation controls to help organizations deploy autonomous agents with confidence. DASF enumerates canonical AI system components, their respective risks, and actionable controls for mitigation.

Step-by-Step: Implementing DASF-Inspired Guardrails with Mosaic AI Gateway

Databricks’ Mosaic AI Gateway provides native guardrail capabilities that can be applied with minimal configuration. Here’s how to implement security guardrails:

Step 1: Enable Safety Filtering

Configure the AI Gateway to enforce safety policies and protect sensitive information in real-time. Guardrails include safety filtering to prevent model interaction with unsafe and harmful content, and personally identifiable information (PII) detection and redaction.

Step 2: Configure Rate Limiting and Policy Filters

Implement rate limits to prevent abuse and policy filters to enforce acceptable usage patterns. This ensures agents operate within defined operational boundaries.

Step 3: Implement Payload Logging and Usage Tracking

Enable comprehensive payload logging and usage tracking for auditability and forensic analysis. This provides visibility into agent actions and enables retrospective security investigations.

Step 4: Apply Least Privilege Access Controls

Configure network isolation and least privilege access to data and AI resources. This ensures agents have only the permissions necessary to perform their intended functions.

Example: Implementing Guardrails via Databricks API

 Configure AI Gateway guardrails programmatically
from databricks import sql

Enable safety filtering and PII redaction
guardrail_config = {
"safety_filtering": True,
"pii_redaction": True,
"rate_limit": {
"requests_per_minute": 100,
"tokens_per_minute": 10000
},
"allowed_actions": ["read", "analyze"],
"blocked_actions": ["execute", "delete"]
}

Apply guardrails to model endpoint
response = client.post("/api/2.0/ai/gateway/endpoints/{endpoint_id}/guardrails", 
json=guardrail_config)

3. AI Red Teaming with Open-Source Frameworks

Red teaming is essential for identifying vulnerabilities in AI systems before attackers exploit them. The Alliance has catalyzed the development of multiple open-source red-teaming frameworks.

BlackIce: Databricks’ Open-Source AI Red Teaming Tool

Databricks contributes BlackIce as an open-source AI red-teaming framework designed to systematically evaluate AI system security. BlackIce enables security teams to simulate adversarial attacks and assess model robustness.

NuGuard: Comprehensive AI Application Security Toolkit

NuGuard is an open-source AI application security toolkit that generates an AI Bill of Materials (AI-SBOM) for agentic applications and then red-teams a running instance with a catalog of 125+ adversarial tests. It performs vulnerability assessment, SBOM generation, and static analysis.

Step-by-Step: Running an AI Red-Teaming Exercise with NuGuard

 Install NuGuard
pip install nuguard

Generate AI-SBOM for your agentic application
nuguard sbom generate --path ./my_agent_app --output sbom.json

Run red-teaming against a running instance
nuguard redteam --target http://localhost:8000 \
--catalog default \
--output report.html

Scan for specific OWASP Agentic AI Top 10 vulnerabilities
nuguard scan --target http://localhost:8000 \
--categories ASI01,ASI02,ASI03

DeepTeam: LLM Red Teaming Framework

DeepTeam is a simple-to-use, open-source LLM red-teaming framework that runs locally and is built on DeepEval, the open-source LLM evaluation framework. It incorporates the latest research to simulate adversarial scenarios.

 Install DeepTeam
pip install deepteam

Run red-teaming against an LLM endpoint
deepteam run --model anthropic/claude-3 \
--categories prompt_injection,harmful_content \
--iterations 100 \
--output results.json

4. Zero-Trust Identity for AI Agents with SPIFFE/SPIRE

As AI agents become autonomous actors within enterprise environments, establishing cryptographic identity and trust becomes paramount. HPE contributes to SPIFFE (Secure Production Identity Framework for Everyone) and SPIRE (SPIFFE Runtime Environment), providing zero-trust identity standards and methods for cryptographically verifying AI agents and services.

Step-by-Step: Implementing SPIFFE/SPIRE for AI Agent Identity

Step 1: Deploy SPIRE Server

SPIRE serves as the certificate authority for your agent ecosystem, issuing identities to workloads.

 Deploy SPIRE server (Docker example)
docker run -d \
--1ame spire-server \
-v $(pwd)/conf/server.conf:/opt/spire/conf/server.conf \
-p 8081:8081 \
gcr.io/spiffe-io/spire-server:latest

Step 2: Register AI Agents as Workloads

Each AI agent must be registered with SPIRE to receive a cryptographic identity.

 Register an AI agent workload
spire-server entry create \
-parentID spiffe://example.org/agent \
-spiffeID spiffe://example.org/ai-agent/agent-001 \
-selector unix:uid:1000

Step 3: Configure SPIRE Agent on Each Host

Deploy SPIRE agents on every host running AI workloads.

 Start SPIRE agent
spire-agent run \
-config conf/agent.conf \
-joinToken ${JOIN_TOKEN}

Step 4: Verify Agent Identity in Workloads

AI agents can now obtain their SPIFFE identity and present it for authentication.

 Python example: Obtain SPIFFE identity
import spiffe

Load agent identity
identity = spiffe.load_identity("/spiffe/agent.sock")

Present identity when calling APIs
headers = {"Authorization": f"Bearer {identity.jwt}"}
response = requests.get("https://api.internal/agent-resources", headers=headers)

5. Securing Model Distribution with Safetensors

Model weight security is a critical supply chain concern. Hugging Face’s Safetensors format, now contributed to the PyTorch Foundation, addresses the security vulnerabilities inherent in traditional serialization formats like pickle. Safetensors stores only tensor data and metadata, eliminating arbitrary code execution paths during model loading.

Step-by-Step: Implementing Safetensors for Model Security

Step 1: Convert Models to Safetensors Format

Convert existing PyTorch or TensorFlow models to the safe format.

import torch
from safetensors.torch import save_file

Load model
model = torch.load("model.pt")

Extract state dict
state_dict = model.state_dict()

Save as safetensors
save_file(state_dict, "model.safetensors")

Step 2: Load Models with Safety Checks

Always load models with security best practices.

from safetensors.torch import load_file

Load safely—no code execution
weights = load_file("model.safetensors")

Verify model architecture separately
model = MyModelClass()
model.load_state_dict(weights)

Never load with trust_remote_code=True from untrusted sources
 Use use_safetensors=True to force safe format

Step 3: Pin Specific Revisions

Protect against upstream changes to model weights.

 Pin to a specific revision when downloading
from huggingface_hub import snapshot_download

snapshot_download(
repo_id="organization/model",
revision="abc123def456",  Specific commit hash
allow_patterns=[".safetensors"]
)

6. Automated Vulnerability Discovery with Microsoft MDASH

Microsoft’s MDASH (Multi-model Agentic Scanning Harness) orchestrates over 100 AI agents to autonomously discover, validate, and remediate vulnerabilities. The system achieved an 88.4% success rate on the CyberGym benchmark, demonstrating production-ready capability.

How MDASH Works:

1. Preparation: Source analysis and threat modeling

2. Scanning: AI agents identify vulnerability candidates

3. Verification: Cross-validation among agents

4. Response: Automated remediation recommendations

Step-by-Step: Implementing Agentic Vulnerability Scanning

While MDASH remains an internal Microsoft tool, its principles can be implemented using open-source alternatives:

 Set up automated vulnerability scanning pipeline
 Example: Using OSS-Fuzz with AI-assisted fuzzing
docker run -it \
-v $(pwd)/src:/src \
gcr.io/oss-fuzz-base/base-builder \
python3 /src/fuzz.py --corpus /src/corpus

Integrate with CI/CD for continuous scanning
 GitHub Actions example
- name: AI Vulnerability Scan
uses: open-ai-security/vuln-scanner@v1
with:
target: ./src
ai_model: claude-3
output_format: sarif

7. Linux and Windows Hardening for AI Workloads

Securing the underlying infrastructure is essential for AI security. Below are hardening commands for both Linux and Windows environments.

Linux: Sandboxing AI Agents

 Install Bubblewrap for lightweight containerization
sudo apt-get update && sudo apt-get install -y bubblewrap

Run an AI agent in a sandbox with restricted permissions
bwrap \
--bind /usr/bin /usr/bin \
--bind /lib /lib \
--bind /lib64 /lib64 \
--proc /proc \
--dev /dev \
--tmpfs /tmp \
--unshare-1et \
--unshare-ipc \
--unshare-pid \
--die-with-parent \
python3 agent.py

Using Docker for production AI agents
docker run -d \
--1ame ai-agent \
--user 1000:1000 \
--read-only \
--tmpfs /tmp \
--cap-drop ALL \
--security-opt no-1ew-privileges \
--security-opt seccomp=seccomp.json \
ai-agent:latest

Linux: VPS Hardening for AI Workloads

 Automated hardening script
sudo apt update && sudo apt upgrade -y

Configure UFW firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw enable

Install and configure Fail2ban
sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Harden SSH configuration
sudo sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Windows: PowerShell Hardening for AI Features

 Detect and remove unnecessary AI features increasing attack surface
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser

Detect AI tools and features
.\detect-ai-features.ps1

Remove Windows Copilot if not required
Get-AppxPackage -AllUsers Copilot | Remove-AppxPackage -AllUsers

Disable AI Recall feature (mitigates CVE-2026-20941)
Get-ScheduledTask -TaskName "MicrosoftWindowsAI" | Disable-ScheduledTask

Implement Windows Defender Application Control for AI workloads
Set-AppLockerPolicy -Policy .\AI_Workload_Policy.xml -Merge

What Undercode Say:

Openness is a defensive necessity, not a liability. The Hugging Face incident—where closed AI tools blocked forensic analysis while open-weight models enabled breach containment—demonstrates that restricting open AI security tools weakens collective defense capacity. Security intelligence locked inside closed systems leaves the broader ecosystem exposed.
The agentic AI security stack requires multi-layer defense. Model weights are just one component. True security demands open guardrails, harnesses, identity frameworks, and governance layers. Organizations must adopt frameworks like DASF that map risks to actionable controls across the entire stack.
Collaborative open-source development accelerates security innovation. By pooling code, model weights, data, and best practices, Alliance members create reusable security components that individual organizations cannot develop independently. The 75+ member coalition spanning chips, cloud, and cybersecurity creates an ecosystem of interoperable security practices.
Regulatory frameworks must recognize open AI as a defensive asset. Blanket restrictions on open frontier AI systems could concentrate critical capabilities in a handful of proprietary providers, reducing cybersecurity resilience globally.

Prediction:

+1 The Open Secure AI Alliance will catalyze the development of an open-source AI security stack that becomes the industry standard within 24-36 months, similar to how OWASP and OpenSSF established benchmarks for application security. Enterprise adoption of open AI security frameworks will accelerate as organizations seek to avoid vendor lock-in and ensure auditability.
+1 AI-powered vulnerability discovery tools like MDASH will evolve into commodity capabilities, democratizing advanced security testing. Small and medium enterprises will gain access to agentic security scanning previously available only to tech giants, leveling the cybersecurity playing field.
-1 The tension between open and closed AI security models will intensify, creating regulatory fragmentation. Some jurisdictions may mandate open security tools while others restrict them, complicating global AI deployments and potentially creating security havens for threat actors.
-1 As AI agents become more autonomous, the attack surface will expand faster than defensive capabilities. The OWASP Agentic AI Top 10 risks—including goal hijacking, tool misuse, and identity abuse—will manifest in real-world incidents before comprehensive mitigations are widely deployed.
+1 The integration of zero-trust identity frameworks like SPIFFE/SPIRE into AI agent architectures will establish cryptographic provenance for AI actions, enabling accountability and forensic traceability that was previously impossible. This will unlock AI adoption in regulated industries including finance, healthcare, and government.

▶️ Related Video (80% Match):

https://www.youtube.com/watch?v=47mW87Czq90

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: Carlo Restelli – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post