Nvidia's new AI security alliance left out OpenAI, Anthropic, Google and Meta — and that's the story

The short version

Nvidia launched the Open Secure AI Alliance with 40+ founding members, but the four biggest frontier labs — OpenAI, Anthropic, Google, and Meta — aren’t in it. The pitch is that open-weight models are “defensive assets” because closed models blocked forensic work during the Hugging Face breach. The absences map almost perfectly onto business model, and that tells you more than the press release does.

What did Nvidia actually announce?

Nvidia announced the Open Secure AI Alliance, a coalition of more than 40 founding members organized to build and share open tooling for AI cyber-defense. The named members include Microsoft, IBM, Red Hat, Hugging Face, Cloudflare, CrowdStrike, Palantir, SpaceXAI, Thinking Machines, and the Linux Foundation. Nvidia’s own contribution is a new agent-harness framework called NOOA, meant to give security teams a shared scaffold for running defensive AI agents against threats.

The core argument in Nvidia’s announcement is a specific one: when the Hugging Face breach happened, closed models made forensic analysis harder because responders couldn’t inspect the weights or reproduce behavior. Open weights, the alliance says, are a defensive asset. If you can see inside the model, you can audit it, patch it, and trace what went wrong. That’s the technical case, and it’s a real one.

But I read the founding member list twice, and the second read is where it got interesting. Because the most quotable part of this alliance isn’t who signed up. It’s who didn’t.

Why does it matter who’s NOT in the room?

Here’s the thing I keep coming back to. OpenAI, Anthropic, Google, and Meta are the four labs everyone thinks of when they say “frontier AI.” Three of them run on closed or partly closed weights as the whole commercial engine. And all four are absent from an alliance whose founding premise is that open weights are safer to defend.

That’s not a coincidence. That’s a business model drawing a line on the floor.

When a coalition forms around a principle, the members are telling you what they can afford to believe. Hugging Face’s entire company is open model distribution. Red Hat sells open-source support. The Linux Foundation is the patron saint of “show me the source.” For all of them, “open weights are a defensive asset” isn’t a sacrifice, it’s a sales pitch that happens to also be true. For OpenAI and Anthropic, the same sentence is a threat to the moat. You can’t join a club whose founding slogan undercuts the thing you charge for.

Meta is the odd one out here, because Llama is famously open-weight. Its absence reads less like ideology and more like Meta preferring to run its own open-model gravity rather than sit at Nvidia’s table. Google straddles both worlds with Gemma and Gemini, so staying out keeps it from picking a public side. Point is, each absence has its own reason, but they rhyme. The split isn’t really open-versus-closed on the merits. It’s open-versus-closed by who profits from which answer.

Is the “open weights are a defensive asset” argument actually right?

Yes, and I want to be fair about that, because it would be easy to dismiss this as pure positioning. It’s not.

During an incident, transparency is genuinely useful. If a model is compromised, poisoned, or behaving strangely, being able to inspect the weights and reproduce the failure locally is the difference between real forensics and guessing. Security people have made this exact argument about software for thirty years. “Many eyes make bugs shallow” is old open-source folklore, and it holds up better than most folklore does. Applying it to model weights is a reasonable extension.

The honest counterpoint is that open weights are also an offensive asset. The same transparency that lets a defender audit a model lets an attacker study it, fine-tune it for abuse, and strip its guardrails. You cannot hand the defenders a searchlight without handing attackers the same searchlight. The frontier labs that stayed closed will tell you their opacity is a safety feature, not just a business one, and they’re not entirely wrong either.

So the real tradeoff the alliance is making is this: it’s betting that in security specifically, defender-side transparency beats attacker-side opacity. I think for defensive tooling that’s probably the right bet. But it’s a bet, not a settled fact, and anyone selling it as obvious is selling you something.

What is NOOA and does it change anything?

NOOA is the agent-harness framework Nvidia contributed to the alliance. In plain terms, an agent harness is the plumbing that lets you run AI agents in a controlled, repeatable way — giving them tools, boundaries, and a place to log what they did. For security teams, that matters because defensive AI agents are useless if you can’t audit their actions or reproduce them across an incident.

The value of NOOA depends entirely on adoption, and this is where the empty chairs bite. A shared harness is worth a lot when everyone uses the same one. It’s worth much less when the four labs building the strongest models refuse to plug into it. You can build a beautiful standard outlet, but if the biggest appliances ship with a different plug, you’ve built a nice regional standard, not a universal one.

That’s my read: NOOA and the alliance are real and useful for the open ecosystem, and they’ll make open-weight security tooling meaningfully better. But calling this “the” secure AI standard would be premature while the frontier is standing outside.

What should you actually do about this?

If you’re building on AI right now, the practical takeaway is to stop treating “open” and “closed” as a values debate and start treating it as a supply-chain decision.

If security auditability, incident forensics, and on-prem control matter to you, the alliance’s tooling and open-weight models just got a stronger case, and you should watch NOOA. If raw capability and managed convenience matter more, the closed labs still have the best models and you’ll live in their ecosystem, absences and all. Most real teams will end up running both, which is exactly why a standard nobody universally adopts is such a headache.

More broadly, this is a reminder to read alliance news by who’s missing. Press releases are written to celebrate the signatures. The signal is usually in the blank space next to them.

FAQ

Who founded the Open Secure AI Alliance? Nvidia founded it alongside 40+ members including Microsoft, IBM, Red Hat, Hugging Face, Cloudflare, CrowdStrike, Palantir, SpaceXAI, Thinking Machines, and the Linux Foundation. Nvidia also contributed the NOOA agent-harness framework.

Why aren’t OpenAI, Anthropic, Google, and Meta members? Nvidia hasn’t published individual reasons, but the alliance’s founding claim — that open weights are a defensive asset — cuts against the closed-weight business model that OpenAI and Anthropic depend on. The absences track closely with how each company makes money.

What is NOOA? NOOA is Nvidia’s contributed agent-harness framework: the plumbing that runs defensive AI agents in a controlled, auditable, repeatable way so security teams can reproduce and trace what an agent did during an incident.

Is the alliance’s security argument legitimate or just marketing? Both. The forensic case for open weights is genuinely sound, but it’s also convenient for members whose businesses are already open. Open weights help defenders and attackers alike, so the alliance is making a bet, not stating a settled fact.

Does this mean open models are more secure than closed ones? Not automatically. Open weights make defensive auditing and forensics easier, but they also let attackers study and modify the model. The alliance is betting defender transparency wins in security specifically, which is plausible but unproven.