Cybersecurity \u00b7 14 August 2026<\/p>\n
At the end of July 2026, NVIDIA launched the Open Secure AI Alliance. In early August, more than 120 organisations were listed, including Microsoft, Cisco, Hugging Face, Red Hat, Mistral, the Linux Foundation and CrowdStrike. OpenAI, Anthropic and Google are not among them. During Black Hat week, the alliance put SAFE (Shared AI Findings Exchange) on the table, a project for confidential AI incident reporting, in RFC with the Linux Foundation. NVIDIA is contributing, among other things, the Garak scanner, OpenShell and the NOOA research bench. For a French SME, the reflex would be to file this under \u201clarge-account business\u201d. That would be a mistake. Agent security is becoming an industry topic, with tools and exchange channels you will not have to reinvent, provided you know what to take from them.<\/p>\n
The signal is clear: infrastructure, cloud, open-model and cybersecurity vendors admit that agents (tools, memory, access rights) create a class of incidents distinct from classic malware. An over-permissioned agent does not need a sophisticated exploit. A poorly framed instruction, a document that is too broad in the RAG, an API key in a prompt, is enough.<\/p>\n
The fact that OpenAI, Anthropic and Google are not on the list forbids nothing. It only indicates that the \u201csecure the open ecosystem and the enterprise\u201d camp is organising alongside the proprietary labs. For a director, that means: your providers do not speak with one voice. Your contracts, your logs and your tests remain the only common ground.<\/p>\n
SAFE, as proposed, aims at a confidential exchange of AI incident findings. It is not an emergency number for VSEs. It is a channel between organisations that agree to share facts without turning them into a press release. A Linux Foundation RFC is not a mandatory standard. It is the start of a common language: how to describe an agent incident without mixing it up with a ransomware incident.<\/p>\n
You do not have to sign an NVIDIA charter to secure a quoting chatbot. You do have to deal with four realities that the alliance, in its own way, puts on the table.<\/p>\n
The Open Secure AI Alliance is not a substitute for the AI Act. Since 2 August 2026, a deployer must inform the user they are talking to AI (Article 50), mark synthetic content (with a deadline of 2 December 2026 for machine-readable marking of systems already on the market) and label professional deepfakes. Prohibited practices remain under a stricter regime (up to \u20ac35 million or 7% of worldwide turnover). The transparency strand goes up to \u20ac15 million or 3%.<\/p>\n
Agent security is another plane: availability, confidentiality, integrity, abuse. A perfectly labelled agent can still exfiltrate a customer file. A well ring-fenced agent can still breach Article 50 if it passes itself off as an adviser. The two jobs are done together. See cybersecurity and AI<\/a>.<\/p>\n Article 4 (AI literacy), applicable since 2 February 2025 to providers and deployers, joins this topic: a member of staff who does not know what an agent is allowed to do is the first incident vector. AI and cybersecurity training<\/a> is not a large-group luxury.<\/p>\n Cybernecs works at the intersection of agents and security, for VSEs and SMEs that do not have a SOC team dedicated to models. Patrick Dajan Mouelle, director, sets the same order at every audit: agent rights, data in the context, log, stop procedure. Industry alliances confirm that this order is not a consultant\u2019s whim.<\/p>\nFour actions this fortnight<\/h2>\n
\n
Where we step in<\/h2>\n