AI agents are moving from chat windows into systems that can browse, write code, use business tools and take actions. That makes them useful, but it also creates a new security problem: when an autonomous system behaves unexpectedly, the lesson often remains trapped inside the organisation that discovered it.
The proposed SAFE AI security framework is designed to change that. Developed through the Open Secure AI Alliance and presented as a Linux Foundation request for comments, the Shared AI Findings Exchange (SAFE) would give organisations a common way to report and learn from security incidents and near misses involving AI systems.
Background: Why AI agents need a new security playbook
Traditional cybersecurity already has established practices for vulnerability disclosure, threat-intelligence sharing and incident response. Agentic AI complicates those practices because failures can emerge from a combination of models, prompts, permissions, external tools and changing environments.
An AI agent may follow an attacker’s hidden instruction on a web page, misuse an authorised tool, expose sensitive information or continue an unsafe chain of actions without a conventional software vulnerability being present. Two companies could encounter versions of the same failure but describe and classify them differently, making shared defence harder.
The Open Secure AI Alliance brings together more than 120 organisations, according to NVIDIA. Contributors to the initial SAFE draft include people from Cisco, CrowdStrike, Hugging Face, NVIDIA and Red Hat, alongside other alliance members. The breadth of the group matters because effective reporting must work across model developers, security vendors, cloud providers, open-source projects and enterprise users.
What the SAFE framework proposes
SAFE stands for Shared AI Findings Exchange. It is not a finished regulation or mandatory compliance standard. It is a draft community proposal seeking feedback on how the industry should collect, analyse and distribute information about AI-related security events.
Confidential reporting of incidents and near misses
A central idea is to collect reports about confirmed incidents as well as near misses. Near-miss reporting is important in high-risk industries because it can expose weak controls before serious harm occurs. Applied to AI agents, it could reveal patterns such as unsafe tool access, prompt-injection pathways or unexpected autonomous behaviour before they become widespread attacks.
Timely notification and coordinated investigation
The proposal aims to support notification of organisations affected by a finding and enable collaborative investigation. Rather than treating every event as an isolated failure, participating organisations could identify common causes across models, software stacks and deployment environments.
Actionable guidance for the wider ecosystem
The long-term value would come from converting confidential reports into useful defensive recommendations. Public guidance could help teams improve permissions, monitoring, testing and deployment controls without disclosing sensitive victim data or handing attackers a detailed playbook.
Why SAFE matters for businesses
Companies are increasingly connecting AI assistants to email, documents, customer records, development tools and internal workflows. That expands the potential impact of a compromised or poorly controlled agent. A shared reporting framework could reduce the time between one organisation discovering a failure and others deploying a defence.
For business leaders, SAFE also highlights an important governance lesson: adopting an AI agent is not simply a software purchase. Organisations need an inventory of agents, clear owners, permission boundaries, activity logs and a process for investigating unexpected actions.
A common incident language could eventually make vendor assessments more useful. Buyers may be able to ask whether providers support recognised disclosure practices, preserve adequate logs and notify customers when a relevant agent-security pattern emerges.
Practical impact for developers and security teams
Developers should not wait for the SAFE proposal to become final. Its direction reinforces controls that are already practical for production AI systems:
- Use least-privilege access: give each agent only the tools and data required for its task.
- Separate trusted instructions from untrusted content: treat web pages, uploaded files and retrieved documents as data rather than authority.
- Log decisions and tool calls: security teams need enough evidence to reconstruct what an agent saw and did.
- Add approval gates: require human confirmation for payments, destructive changes, external messages and access to sensitive records.
- Test realistic attack chains: evaluate indirect prompt injection, credential exposure, excessive autonomy and cross-tool escalation.
- Document near misses: record blocked or narrowly avoided events instead of tracking only confirmed breaches.
If SAFE gains adoption, teams may also need processes for deciding what to report, removing personal or confidential data, coordinating with vendors and translating external findings into internal detection rules.
Risks, limitations and open questions
The framework is still a proposal, so implementation details may change. Voluntary reporting systems can suffer from uneven participation, especially when companies fear reputational damage or legal exposure. Reports also need enough technical detail to be useful without revealing customer information, proprietary systems or exploitable weaknesses.
Independent governance will be essential. A framework dominated by one vendor or one part of the AI supply chain could produce incomplete conclusions. Smaller developers and researchers must also be able to participate without facing an excessive compliance burden.
Another challenge is classification. AI incidents can involve conventional software bugs, human error, malicious prompts, model behaviour and excessive permissions at the same time. SAFE will need clear definitions and interoperable formats if findings are to become machine-readable threat intelligence rather than a collection of incompatible narratives.
What to watch next
The immediate milestone is the response to the Linux Foundation’s request for comments. Watch for details on governance, confidentiality protections, incident categories, reporting timelines and how findings will be shared with affected parties and the public.
Adoption will matter more than the announcement. Support from cloud platforms, model providers, enterprise software companies and independent security researchers would make it more likely that SAFE becomes a useful cross-industry mechanism. Integration with existing incident-response and vulnerability-disclosure systems will also determine whether teams can use it without creating a parallel bureaucracy.
Conclusion
The SAFE AI security framework reflects a simple but important idea: the industry should learn collectively when AI agents fail. Confidentially sharing incidents and near misses could help organisations recognise recurring attack patterns, notify affected parties and publish better defensive guidance.
SAFE is not yet a final standard, and it will not replace strong controls inside each organisation. But as AI agents gain access to more valuable tools and data, a trusted exchange for security findings could become a critical part of the agentic AI ecosystem.