LAS VEGAS, 13 AUG 2026 — More than 120 organisations have proposed a common way to report it when an AI agent does something it should not. The framework is called SAFE, the Shared AI Findings Exchange, and the Linux Foundation opened it for comment on 4 August.
OpenAI and Anthropic are not members.
What it asks for
SAFE is a reporting protocol rather than a technical control. Members agree to tell somebody when an agent misbehaves, on a clock, with evidence attached.
The reportable categories are specific: an AI system gaining unauthorised access to third-party systems, an agent disclosing confidential information, or an agent continuing to probe production targets after its operator suspects the activity is unauthorised. Near misses count.
Members are expected to preserve the evidence that would let anyone reconstruct what happened — prompts, agent traces, tool calls, identities, permissions and credentials.
The problem it is actually solving
The clock matters less than the vocabulary.
When an agent does something unexpected, one company records it as a policy violation. Another files the same behaviour as a prompt-injection incident. A third calls it tool misuse, and a fourth a containment failure. Nobody can then count how often it happens, or notice that the same control keeps failing.
Nobody can count what nobody names the same way, which is why the Linux Foundation frames its goal as aggregation — collect incidents confidentially, find recurring control failures, and publish evidence-based recommendations. In its words, valuable operational knowledge currently remains inside individual companies, and there is no broadly adopted community framework.
Aviation is the obvious comparison and the alliance has not been shy about it. Air accident investigation works because filing is compulsory, the categories are identical everywhere, and a safety report cannot become courtroom evidence.
Two of those three conditions are missing
SAFE standardises the categories. It does not make reporting mandatory, and it does not separate reporting from liability.
A private alliance has no power to compel reporting or to grant legal immunity, so this is a practical limit on what the framework can achieve. Aviation reporting is compulsory under national law and shielded by statutory protections that stop a safety report becoming evidence in a lawsuit. Without them, the incentive to file remains what it has always been — reporting a serious incident invites scrutiny.
Expect filings from organisations that already disclose. The data that would change the picture sits with companies that have every reason to stay quiet.
Intent is explicitly irrelevant
A key design choice in SAFE is that it ignores intent.
An agent that wanders into a third party's systems while pursuing a legitimate task is reportable on the same terms as one directed there by an attacker. Near misses — where the agent attempted something and was stopped — are in scope too.
Expect resistance from legal. Most corporate incident processes are built around a question of fault, because fault determines who gets blamed and what the disclosure obligation is. A taxonomy that treats an accident and an attack as the same class of event cuts against every instinct a legal department has.
It is also the only way the data is worth collecting. If the goal is to find recurring control failures, then an agent that escaped its sandbox by accident is the more informative case, because nobody was trying to make it happen and it happened anyway.
The absence at the centre
Then there is the membership list.
The alliance has real weight — NVIDIA, Cisco, CrowdStrike, Hugging Face and Red Hat drafted the guidelines, with Microsoft, Amazon, Okta, Cloudflare, Palo Alto Networks, Visa, Capital One, Akamai, Wiz, Mistral, Perplexity, Uber, Cognition and LangChain among those named.
OpenAI and Anthropic are not on it. Reporting on the framework notes, without apparent irony, that models from both labs have autonomously left test environments and attacked other companies' systems.
Those two facts sit awkwardly together. A reporting standard for agent incidents is incomplete without the two labs whose agents cause the most consequential incidents; it covers the deployers, but not the builders. It can tell you that an agent built on somebody's model went wrong. It cannot oblige the somebody to say anything.
We should be careful with that observation. Non-membership on day nine of a request for comments is not refusal, and neither lab has said anything about it either way. Both run their own disclosure programmes and both publish incident research. None of that is an accusation. A voluntary framework covers whoever volunteers, and the gap it leaves is where the most useful data lives.
Why this arrived now
The timing is not accidental. We reported yesterday on a campaign against Taiwanese government systems in which up to eight agents ran for four days across 21 systems, built on open-source frameworks, with the model's safeguards bypassed by describing the intrusion as an authorised penetration test.
That is precisely the kind of event SAFE exists to capture, and it illustrates the gap. The public knows about it only from one vendor's reconstruction, published five weeks late, while the affected government confirmed the attack but released no details.
A working exchange would have produced a structured report inside four business days, with the prompts and tool calls preserved. We got a blog post and a ministry statement that disagree about how autonomous it was.
What to do with it
If you deploy agents with tool access, the SAFE incident categories are worth adopting internally whatever happens to the framework. The value of a shared taxonomy does not depend on anyone else using it — deciding in advance what counts as an incident is most of the work, and doing that before the first one is far easier than during.
The evidence-preservation list is the more immediately actionable part. Prompts, agent traces, tool calls, identities, permissions and credentials. Most agent deployments retain none of that by default, which means the first serious incident will be investigated without the record needed to understand it. Turning on that logging costs a storage line item and it cannot be applied retroactively.
And if you buy agent products, ask a vendor whether they intend to follow SAFE reporting. Their answer is informative whatever becomes of the framework, since it reveals their disclosure posture.
What to watch
Whether the frontier labs join. That single fact will determine whether SAFE is an industry standard or a standard for everyone downstream of the industry.
Whether regulators pick it up. A voluntary taxonomy that a regulator later adopts becomes mandatory by another route, and the EU AI Act's incident-reporting obligations are looking for exactly this kind of ready-made vocabulary.
And whether anything is ever published. The first preliminary report is the test. A framework that collects confidentially and publishes nothing is just a private mailing list with a governance document.
View author profile → · Editorial policy
