Nvidia-led Open Secure AI Alliance, formed a week ago with over 120 member companies, has already launched a working group called SAFE to develop AI cybersecurity guidelines including confidential incident reporting and blame-free analysis protocols. Members are contributing open source tools such as Nvidia's Garak vulnerability scanner, Amazon's Strands Agents, and Okta's agent identity technology to create a shared security framework. The group aims to build an open source ecosystem for securing AI agents in enterprises, though notable absences include Anthropic, OpenAI, and Google despite their support for the original letter.
OpenAI described incidents where third-party cybersecurity evaluations of its models revealed vulnerabilities and outlined new safeguards for future testing procedures. The company did not disclose specific numbers of incidents or affected systems in the announcement. OpenAI's new evaluation framework aims to improve coordination between external testers and the company to prevent unauthorized access or data leaks during security assessments.
BackEngine launched MCP (Model Context Protocol), a system enabling AI models to securely access private company knowledge and databases without exposing sensitive data. The framework integrates with Claude and other AI systems through a standardized interface. This allows enterprises to use AI assistants on proprietary information while maintaining data governance and security controls.
The Open Secure AI Alliance, comprising over 120 organizations, is developing SAFE (Shared AI Findings Exchange) guidelines to improve cybersecurity for agentic AI systems by enabling confidential incident sharing and collective defense. The framework includes contributions from NVIDIA, Cisco, CrowdStrike, Hugging Face, Red Hat, and newer members like Amazon and Visa, spanning identity controls, harnesses, runtime guardrails, specialized security models, and observability tools. Organizations can now share threat intelligence and security findings openly to accelerate ecosystem-wide protection against AI-specific attack surfaces.
Monava, a Swedish-Finnish company specializing in AI-powered acoustic drone detection, has closed a funding round led by Gungnir Capital alongside Foundry Ventures and Hede Capital. Drones account for roughly 70 percent of all casualties in Ukraine's war, and Monava's passive detection system is already deployed across the Nordics and Ukraine. The funding will accelerate product commercialization and organizational scaling to meet rapidly growing demand from European defence customers.
Deel acquired Clarity, a Tel Aviv-based deepfake-detection startup, for $45–50 million in its 15th acquisition, as the HR platform announced it surpassed $1.5 billion in annual recurring revenue. Clarity's continuous identity verification technology will integrate into Deel's hiring, onboarding, and IT access systems across the platform. This addresses Gartner's projection that one in four candidate profiles globally will be fraudulent by 2028, embedding trust checks throughout employment rather than only at initial hiring.
Box's VP of DACH discusses how companies can adopt AI securely by consolidating unstructured data and automating governance controls rather than choosing between security and usability. He emphasizes that scattered data limits AI effectiveness, citing examples like service technicians receiving outdated information when documents sit in separate systems. Organizations should prepare their data infrastructure and user permission systems before deploying AI models, reducing security risks and Shadow AI adoption where employees use unsanctioned tools.
NVIDIA SkillSpector is a security auditing tool that scans AI agent skills for vulnerabilities using LangGraph, YARA rules, and SARIF reports. The tutorial demonstrates scanning four synthetic skills—pdf-summarizer, repo-janitor, invoice-sync, and notes-mcp—with risk scores ranging from clean to malicious, including detection of embedded credential theft, command injection, and unapproved telemetry beacons. Results enable teams to suppress baseline findings, detect regressions, enforce CI security gates, and visualize fleet-wide risk distribution before deployment.
A roundup covering an AI notetaker startup rejecting surveillance business models, OpenAI's cyberattack on Hugging Face prompting congressional interest in AI regulation, and arguments for building personal software rather than relying on commercial SaaS platforms. Chris Pedregal's startup Granola refuses to sell user transcript data to employers despite pressure from companies seeking access. The article discusses broader tensions over AI transparency, data ownership, and whether individuals should build their own tools instead of depending on centralized services.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
