The proposed program, often referred to as the SAFE AI agent safety reporting system, is an industry-led effort to collect, share and learn from AI-related security incidents, especially those involving agentic or autonomous AI models. Today, most organizations handle AI security incidents internally. As a result, operational lessons stay locked inside individual companies. There is currently no widely adopted framework for:

• Confidentially sharing AI operational failures
• Spotting recurring control or governance gaps across incidents
• Turning those lessons into reusable defensive guidance for others

The alliance of more than 100 tech companies and organizations wants to change that. Under the proposal, a neutral exchange would:

• Collect structured information about AI-related security incidents
• Share relevant details with affected organizations
• Identify patterns and common failure modes across incidents
• Publish recommendations and defensive practices based on those insights

The goal is to help the ecosystem rethink how it manages AI agent risk by turning individual incidents into shared learning, rather than isolated crises.

The proposal outlines specific expectations for how and when members would report AI-related security incidents. While details may evolve, the current draft suggests:

• Customer notification within 72 hours of a credible data exposure linked to an AI incident.
• Reporting to the exchange within four business days of an incident, so the broader community can start to understand what happened.
• Preliminary public or shared report within 30 days, subject to security, legal and investigative constraints.

Members would be expected to report incidents involving both commercial and open-source AI systems. The intent is to create a consistent, predictable process that:

• Gives customers timely awareness of potential exposure
• Provides the community with early signals about emerging attack patterns
• Allows organizations enough time to investigate before publishing a more complete preliminary report

The Linux Foundation, which is helping lead the effort, has published a request for comments, so these timelines are designed as a starting point that industry stakeholders can refine together.

The SAFE proposal is being driven by an alliance of more than 100 technology companies and organizations, coordinated in part by the Linux Foundation. Several well-known industry players helped draft the proposal, including:

• Cisco
• CrowdStrike
• Hugging Face
• NVIDIA
• Red Hat

The Linux Foundation has emphasized that the system would operate neutrally and free from the control of any single vendor. That neutrality is important because the program is intended to:

• Cover incidents across both proprietary and open-source AI systems
• Encourage broad participation, including competitors
• Build trust that shared data will not be used for commercial advantage

It is worth noting that some of the most influential AI labs, including OpenAI and Anthropic, are not currently members of the Open Secure AI Alliance behind this proposal. That raises open questions about how much traction the guidelines will gain in both policy circles and the wider AI community. Even so, the initiative signals a shift toward reimagining AI incident response as a shared, cross-industry responsibility, rather than something each organization handles in isolation.