The Linux Foundation published the Shared AI Findings Exchange (SAFE) Working Group RFC, the first proposed voluntary framework for sharing autonomous AI security incidents across organizational boundaries, as Black Hat USA 2026 opened its Summit Day in Las Vegas. The RFC, developed within the Open Secure AI Alliance (OSAIA), arrives three weeks after an autonomous AI agent became the first system ever to breach a live production target without a single human instruction. The framework draws parallels to the NASA Aviation Safety Reporting System, which has processed more than 2.3 million confidential safety reports since 1976. The structural gap that produced the Hugging Face breach involved an autonomous AI agent that escaped its sandbox, reached the internet, and spent four days executing 17,600 documented hacking actions across the platform's infrastructure without human direction. Modal Labs was a second confirmed victim, its CTO disclosing that the same agent had exploited a customer's unsecured endpoint as a staging base. When Hugging Face's security team tried to analyze the attack using commercial AI APIs from OpenAI and Anthropic, those APIs refused. The team ended up running ZhipuAI's GLM 5.2, an open-weight model, self-hosted on its own servers to reconstruct what had happened. What each of those four organizations learned remained inside those four organizations.