40 AI Rivals Just Formed a Security Alliance. Nobody Made Them.

Someone broke into OpenAI, and the company said so out loud.

Then the odd part. On July 27, 40 companies launched a group called the Open Secure AI Alliance. Nvidia, Microsoft, SpaceX, and Palantir are among the members. Their stated job is AI security governance, plus the auditing that makes governance mean anything. No law required this. No hearing forced it. A disclosed attack landed on one company, and 40 rivals moved within days.

A breach like that means a security team working nights and a customer call list nobody wants. Every company on that list of 40 knows the feeling is coming for them too.

I have watched industries meet a shock like this one for 20 years. They almost never respond this way.

The usual pattern runs in 3 steps. Ignore the new thing. Shame the people using it. Then push hard for rules that freeze the market where it sits. I saw all 3 from inside at Napster. The music business spent years calling its own best customers thieves. By the time it moved, the rules were being written by people who had never sold a record. The songs kept coming. Some of the loudest companies did not. The people who paid for that fight were rarely the executives. Studio engineers and record store clerks watched a whole way of working expire while lawyers argued about who owed whom.

This time the industry skipped the first 2 steps.

Watch any parent hand a phone to a kid and read the permission screen out loud. Camera. Microphone. Contacts. Files. You tap accept, because the other choice is your kid being the only one locked out. Boards are making the same tap right now, at a far larger scale. We are giving software agents the keys to email, code, customer records, and money. Then we hope the security kept pace. Trust is being handed over faster than anyone is checking it.

That gap is what these 40 companies just pointed at.

I would not call the motive pure. A breach costs money, board time, and customer trust, and fear has always moved faster than principle. That is fine. Most governance that lasts starts as damage control. Seatbelt laws and fire codes each followed something going badly wrong, and each became ordinary within a generation. The test here is whether the auditing outlives the news cycle.

Voluntary standards get dismissed as public relations, and plenty of them earn it. The word to watch in this one is auditing. A pledge is a press release. An audit has a scope, a date, a finding, and a name attached to the finding. If this group builds that, it will have done the thing regulators cannot do quickly: set a floor while the technology is still moving.

For a board, the first move is smaller than joining anything. Ask which security review your own company would pass this quarter, and how you would know the answer is true. Ask whose name goes on it. Plenty of directors can name their cyber insurance carrier and cannot name a single AI agent running inside their operations. Closing that gap costs a question, long before it costs a budget.

If you work in government, this lands on your desk in a specific way. A voluntary standard that holds gives you something real to point at, and to build on. One that fades hands you a mandate to write from scratch, on deadline, with less information than the people you are regulating. Both outcomes are live right now. I advise the California State University system on AI governance, and public institutions are asking the same question at their own scale: who checks the agents we just handed the keys to?

In my forthcoming book, The Great Relearning, I call this territory Above the Algorithm: judgment, taste, trust, accountability, and the work of directing agents that keep getting better. A security alliance is a bet on exactly that. Machines will find flaws faster than any person can. People still decide what counts as safe enough to ship, and who picks up the phone when it was not. The agents will keep getting more capable. The judgment about where to point them stays a human job, and so does the answer when one goes wrong.

Breaches make headlines. Audits make governance.

This reaches well past the server room. Agent security decides whether a hospital lets software touch a patient chart, and whether your bank lets it move your money. Behind those are somebody's health and somebody's paycheck. The companies writing rules this summer are setting defaults that ordinary people will live inside for a decade, without ever reading one word of them.

So here is what I would ask in your next leadership meeting. I am asking it in mine. Which agents inside our company already reach something we would hate to lose? Who outside our own team has ever checked that reach? And what do we do in the first hour, if the answer shows up as a phone call at 2 a.m.?

If you do not hold the budget, a version of this still belongs to you. Ask what your employer's AI tools can see, and who reviews it. A company worth staying at can answer that plainly.

Skipping steps 1 and 2 is a low bar. It is also the rarest thing in this story. Industries that survive their own disruption tend to be the ones that wrote the first draft of the rules, before someone wrote a worse draft for them. Who is writing yours? And if you read this differently, I am easy to find.

Sources: CNBC, July 27, 2026, on the formation of the Open Secure AI Alliance; additional coverage in Business Standard, Quartz, and MLQ News, July 2026.

Alex advises boards and public institutions, including the California State University system, on building AI governance that holds up before regulators ask.

Ready to pressure-test your own AI security governance? Book a conversation →