What happened
At Open Source SecurityCon North America on 9 November 2026 (confirmed via json-ld datePublished=2026-11-09 on the fetched press release), OpenSSF announced expanded AI security work: (1) joining MOSAIC (Multi-Organization Secure AI Coordination) to pool knowledge and produce consistent AI-security standards and guidance, with a goal of a standardised map of participating initiatives aligning with NIST SP 800-53 control SC-42 and other frameworks; (2) release of a new guide 'Finding and Fixing Software Vulnerabilities Using AI: A Guide for Developers' from its Best Practices and AI/ML working groups, covering preparing/sandboxing AI, validating and fixing issues, and stressing AI-generated patches must never be trusted without automated tests and human review (with an accompanying LFD126 course planned); (3) launching the Secure AI Associate (SAIA) certification (December 2026) covering the AI/ML lifecycle from training data to production pipelines; and (4) support for the 'State of AI Impact on Software Security and Cybersecurity 2026' report, which found 58% of teams ship code faster than security reviews can keep up and 60% say AI coding assistants increased external packages in their codebases.
Why it matters
OpenSSF is a recognised cross-industry body (Linux Foundation) for open-source software security. Its new AI-security guidance, MOSAIC collaboration, and SAIA credential give software teams concrete, tool-agnostic practices for securing AI-assisted development and AI/ML supply chains, and they aim to align with NIST SP 800-53 SC-42. This is practical guidance directly relevant as AI coding assistants accelerate SDLC and shrink the bug-discovery-to-attack window.
Action needed
Software security and DevSecOps teams should adopt the 'Finding and Fixing Software Vulnerabilities Using AI' guide and the SAIA certification for AI/ML lifecycle skills; track OpenSSF/MOSAIC output as it aligns with NIST SP 800-53 SC-42.