NVIDIA-led OSAA: In the AI Agent era, why open-source weights have become a "defensive weapon"

On July 27, 2026, NVIDIA, together with more than 30 companies including Microsoft, Hugging Face and the Linux Foundation, founded the Open Secure AI Alliance (OSAA) and open-sourced the Agent governance framework NOOA. The direct trigger was the Hugging Face security incident in July: the defender was blocked by a security guardrail when using a closed-source API model for intrusion forensics, and finally only ran the open-source weight GLM-5.2 on its own infrastructure to complete the log reconstruction of approximately 17,600 attack behaviors. This article sorts out the mission of OSAA, the technical highlights of NOOA, the alliance contributions such as Safetensors and MDASH, and puts forward practical suggestions for security teams such as pre-installing local forensics models and auditing Agent full stacks.