ClickHouse joins alliance to boost AI security forensics

ClickHouse has joined the Open Secure AI Alliance, a group that includes NVIDIA and other technology companies focused on AI security.

The move puts ClickHouse inside an industry effort to develop open models, tools and techniques that organisations can use to inspect and run AI security systems on their own infrastructure. The alliance emerged in part from lessons drawn after an AI agent breach at Hugging Face, where investigators had to review more than 17,000 actions to reconstruct what the agent had done.

Its work in the alliance will focus on the evidence and audit trail needed when AI agents are compromised or behave unexpectedly. That includes open instrumentation and trace schemas for agent forensics built on OpenTelemetry, evaluation pipelines designed to detect unusual agent behaviour, and reference architectures for air-gapped observability in regulated or sovereign environments.

The role reflects growing concern across the sector that AI security depends not only on model behaviour but also on the broader systems around it, including identity controls, permissions, guardrails, logs and evaluation methods. Open approaches are drawing attention from security teams that want to inspect and adapt the tools they use rather than rely entirely on closed services.

Audit trail

At the centre of ClickHouse's contribution is Langfuse, an open-source platform for agent tracing, evaluations and guardrail monitoring. It is designed to give engineering and security teams a record of what large language model applications and AI agents do in production, including model calls, tool use, retrieval steps and intermediate decisions.

More than 100,000 engineers use Langfuse, including teams at 21 of the Fortune 50, according to ClickHouse. The company said the platform processes more than 10 billion observations each month and that the open-source project has 32,000 GitHub stars and more than 300 contributors.

Langfuse is intended to work across different model types and software frameworks. It can trace agents running on self-hosted open-weight models as well as closed APIs, while supporting instrumentation for LangChain, LlamaIndex, the Vercel AI SDK and the OpenAI SDK. Other systems can connect through OpenTelemetry.

The platform can also monitor guardrail pipelines built with tools including NVIDIA NeMo Guardrails and LLM Guard. That allows teams to compare how checks perform on live traffic and maintain a record of how outputs were assessed.

Open infrastructure

ClickHouse argued that the data generated by AI agents is now an analytical workload in its own right. Langfuse stores every trace in ClickHouse, with the database handling spans, tool calls and evaluation scores that responders may need to query quickly during an incident.

It described this evidence layer as central to AI security investigations. In practice, that means preserving an open, inspectable record that engineers, security teams and compliance functions can access when an agent causes harm or operates outside expected limits.

That position also reflects demand from organisations in highly regulated sectors, where AI systems may need to run in air-gapped environments and audit records must remain under direct organisational control. Langfuse can run on a customer's own infrastructure, so traces do not have to leave the network where they were created.

Alliance membership also places ClickHouse alongside companies already using its database in security-heavy settings. Cisco Talos uses ClickHouse Cloud for its threat intelligence reputation service, according to the company, while Cloudflare has described using ClickHouse in its bot management platform to log detections across a network averaging 11 million requests per second.

Security pressure

The expansion of AI agents in software development, operations and customer-facing services has pushed security questions higher up the agenda. Unlike conventional applications, agents can make a chain of decisions, call external tools and interact with multiple systems, making post-incident reconstruction more complex.

The Hugging Face incident cited by the alliance has sharpened that debate by exposing the practical difficulty of understanding an agent's actions after a breach. The alliance's emphasis on open tools suggests that some vendors and users see forensic access, transparency and control as becoming core requirements for defending AI systems.

ClickHouse is best known as an open-source columnar database built for real-time data processing and analytics. Its entry into the alliance shows how database and observability vendors are positioning themselves as part of the AI security stack, particularly where large-scale trace data and rapid incident analysis are involved.

Security teams already run some of their heaviest workloads on the platform.