SAFE Guidelines for Agentic AI Cybersecurity Are Taking Shape Inside the Open Secure AI Alliance

The Open Secure AI Alliance, which now counts more than 120 organisations among its members, is developing a new framework called SAFE guidelines, designed to improve cybersecurity transparency for agentic AI systems. This is exactly the kind of unglamorous, standards-setting work that ends up mattering enormously once AI agents are embedded deeply enough in enterprise infrastructure that a compromise becomes a serious incident rather than a nuisance.

Agentic AI is the flavour of AI that acts rather than just responds. These systems can browse the web, write and execute code, send emails, query databases, and chain together complex multi-step tasks with minimal human supervision. They are already being deployed in customer service, software development, financial analysis, and supply chain management. And they introduce a genuinely new category of cybersecurity risk.

What Makes Agentic AI Risky From a Security Perspective

Traditional software has a relatively well-understood attack surface. You audit the code, you patch known vulnerabilities, you monitor network traffic, you control access permissions. Agentic AI scrambles that model in several ways.

First, agents often have broad permissions by design. An AI agent that can manage your email, browse the internet, and execute scripts needs access to a lot of systems. That access, if compromised or manipulated, becomes a very wide blast radius. Second, agents can be manipulated through their inputs in ways that traditional software cannot. Prompt injection, where a malicious actor embeds instructions in data that the agent will process, is a real and poorly understood attack vector. An agent browsing a web page could encounter text designed to hijack its behaviour, and the agent has no way to tell that the text is adversarial rather than legitimate content.

Third, agentic systems often operate opaquely. If an agent takes a sequence of actions that causes harm, tracing exactly what decision chain led to that outcome is genuinely difficult. The SAFE acronym, though the alliance has not yet published the full definition, presumably addresses some combination of Security, Accountability, Fairness, and Explainability, which are precisely the properties you need to debug a misbehaving agent.

The transparency angle is particularly important. For enterprises deploying agentic AI, knowing what an agent can access, what decisions it is making, and what safeguards are in place is not optional. It is the kind of information that boards, regulators, and insurers are starting to demand. The EU AI Act is already pushing in this direction for high-risk AI applications. SAFE guidelines could become the industry's answer to those regulatory demands: a voluntary but coherent framework that companies can point to as evidence of responsible deployment.

The Open Secure AI Alliance's 120-plus member base gives these guidelines real weight. If the major AI developers, cloud providers, and enterprise software companies that make up that membership adopt SAFE guidelines, they effectively become the de facto standard, regardless of whether they are formally mandated by any regulator.

The hard part, as with any security standard, is enforcement and verification. Guidelines that companies self-report compliance with are very different from guidelines backed by audits, certifications, or regulatory teeth. The history of voluntary cybersecurity frameworks is mixed: some, like the NIST Cybersecurity Framework, have been genuinely influential. Others have been box-ticking exercises that provided cover without improving security.

What the alliance does next, specifically whether it builds in any verification mechanisms and how prescriptive the technical guidance gets, will determine whether SAFE guidelines are a meaningful step forward or a well-intentioned document that sits in a drawer. Given the pace at which agentic AI is being deployed, that answer needs to come quickly.