--- title: "Flight Recorders Without Immunity" canonical: "https://current.tinyfish.ai/issue/42/market-pulse/article/34888/flight-recorders-without-immunity" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" author: "Sable Whitford" author_url: "https://current.tinyfish.ai/team/201" issue: 42 section: "market-pulse" section_name: "Market Pulse" published: 2026-08-12 updated: 2026-08-13 word_count: 271 source_links: 5 --- # Flight Recorders Without Immunity *By [Sable Whitford]()* *August 12, 2026* [Read on the website]() A [coalition of 120-plus organizations](https://www.axios.com/2026/08/11/open-source-security-ai-agent-reporting) wants AI agent incidents reported like aviation near-misses: preserve evidence, notify affected parties, publish de-identified findings. The [SAFE RFC](https://github.com/OpenSecureAIAlliance/RFCs/blob/main/rfc-safe-proposal.md) specifies tight timelines and detailed evidence requirements — prompts, traces, tool calls, credentials, human interventions, the full operational record. Anyone who has written a blameless postmortem knows the precondition: you need people to tell the truth. The FAA's Aviation Safety Reporting System gets a million-plus reports because NASA holds the data, reporters receive [codified immunity](https://asrs.arc.nasa.gov/overview/immunity.html) from enforcement action, and identities are stripped before anything enters the database. [Zero identities breached](https://asrs.arc.nasa.gov/overview/confidentiality.html), ever. SAFE has none of that infrastructure. The RFC says it plainly: "regulators and affected parties retain their legal rights." So the telemetry you preserve to help the ecosystem learn is also the telemetry a plaintiff's attorney can request in discovery. Until someone solves that, expect rational actors to behave rationally. **Context:** Proposed weeks after an [OpenAI evaluation model compromised Hugging Face infrastructure](https://openai.com/index/hugging-face-model-evaluation-security-incident/) — the kind of agent-caused incident SAFE would cover **SAFE notification timelines** - Immediately: notify affected org - 72 hrs: notify exposed customers - 4 business days: confidential report - 30 days: public preliminary findings - 90 days: remediation status **What makes aviation reporting work** - Independent custodian (NASA, not the FAA) - Statutory penalty waiver for qualifying reports - Full de-identification before database entry **What SAFE currently lacks** - Independent third-party data holder - Codified enforcement immunity - Legal safe harbor of any kind - Governance structure or formal adoption **From the RFC** "Believing that an environment was simulated may explain an incident, but it does not remove the duty to report it." ## More - [Market Pulse — Issue 42]() - [Issue 42]() - [Publication guide]()