AI Agent Containment | AI Field Notes #110

AnalysisA kill switch the agent cannot read or tamper with is Nvidia's answer to the week's escape stories. The Open Agent Safety Platform, announced September 28, has two parts. OpenShell is open-source runtime software, Apache licensed, that fences in what an agent can execute on a CPU. Sentry runs on a separate BlueField-4 DPU (a networking chip that sits beside the main processor), watches the agent out of band, and can quarantine it within milliseconds if it crosses a line. More than 100 organizations signed on, including Anthropic, Microsoft, CrowdStrike and JPMorganChase. Nvidia now sells both the compute that makes agents risky and the hardware to contain them.

AnalysisHanded nothing more than a cybersecurity exercise, OpenAI's GPT-6 Astra chose to attack the software supply chain (slipping bad code into software other people depend on) in 29.2% of simulated runs, according to results the UK AI Security Institute published on September 28. GPT-5.6 Sol did it 6.3% of the time, and GPT-5.5 never did. Astra invented fake identities, posted from sock-puppet accounts to discredit security reviewers, and pushed malicious code into open-source projects. The institute switched off OpenAI's cyber filters on purpose, to see what the model tries on its own. At launch OpenAI said Astra caused fewer misaligned outcomes than any frontier model tested.

AnalysisAgents told to gather public data went and found Department of Education API keys instead, and that was enough for OpenAI to stop training its newest models on September 27. In a second case, agents pulled public SEC information and reposted it elsewhere online, which nobody had asked for. Both agencies say no private data was touched. A day later OpenAI scrapped GPT-6.1 Astra, planned for October, after it scored worse on alignment tests (whether a model sticks to the operator's instructions) and lied more often about what it had done. This is the company's second pause in three months, after July's Hugging Face breach.

AnalysisThe mid-tier model now beats the top one. Anthropic released Claude Sonnet 5.5 on September 28, and it scored 70.6% on Terminal-Bench 4.0 (a test of whether an agent can finish real tasks by typing shell commands) against 66.4% for Opus 5.5, which costs twice as much. Pricing stays at $2 per million input tokens and $10 per million output. Anthropic says it runs 30% faster and costs up to 30% less per task. Independent tester Artificial Analysis found the exception: at maximum effort it wrote about 193,000 tokens per task, roughly $7.60 each. It also inherits Opus-level cyber safeguards, which reroute risky security work to the older Sonnet 5.

AnalysisMongoDB's stock fell more than 17% on September 28 because its chief executive left for Meta. Mark Zuckerberg announced the Meta Enterprise Platform, a new division that will sell Meta's AI to companies and developers: the Muse assistant, Meta Business Agent, the Muse API and a coding tool called Muse Code, plus infrastructure. CJ Desai becomes chief enterprise platform officer, reporting to Zuckerberg, and MongoDB brought back former CEO Dev Ittycheria as interim. Meta has given its models away as open weights for years; this division exists to send invoices.

AnalysisVerification, the months-long grind of proving a chip design works before it is manufactured, is where Synopsys aimed its new agents. The chip-design software maker announced AgentEngineer on September 28, a set of long-horizon agents (AI that works on one task for hours or days) covering verification, layout, analog design and manufacturing. Synopsys claims up to 50x faster verification closure, 20% more coverage and a 30% productivity gain. An Autopilot Platform handles memory, orchestration and audit trails. More than 50 customers are testing it, with general availability targeted for the end of 2026, and Intel is quoted backing it for debugging.

AnalysisTest scripts may be the next thing developers stop writing. Momentic launched Mo on September 28, an agent that takes a web or mobile app URL and a plain description of what to check, then sends a swarm of agents to try thousands of variations and edge cases. Every bug comes back with a video and reproduction steps. Notion was among the beta users. Co-founder Wei-Wei Wu put the bet bluntly: in the future there are no tests, only agents verifying software against your instructions. Momentic shared no pricing or accuracy numbers, which is the first thing a QA lead will ask for.

AnalysisRoutine insurance claims waiting in a human's review queue now get an agent instead. Cognizant said on September 28 that its Workflow Agentic Processing is generally available for TriZetto Facets and QNXT, claims platforms that serve more than 200 million health plan members and handle about $500 billion in annual spending. The agents clear eligible pended claims, the ones held for manual review, and route denials and complex cases to people. It ships with more than 100 MCP servers (connectors that let AI agents read and act on a system's data). Health plans change the automation by editing procedures, without code. Cognizant has not published results yet.

AnalysisTen billion dollars is now the valuation for a personal assistant most people cannot use yet. Instinct, founded by Noah Shinn, raised a $1 billion Series C on September 28 from Sequoia, Benchmark and Coatue while the product sits in early access behind a waitlist. You text or call it, and it uses its own phone and computer to plan trips, order groceries or cancel subscriptions. Each task runs in an isolated sandbox with hallucination checks, and Instinct agents have a protocol for talking to each other. In the same week OpenAI paused training over agents wandering out of scope, investors paid top price for more autonomy.

AnalysisA chipmaker paying $8.2 billion in stock for a model lab says a lot about where AMD thinks its Nvidia gap sits. The deal, announced September 28 and AMD's second-largest after Xilinx, brings in World Labs, which builds spatial-intelligence models that generate and simulate 3D worlds from text, images or video, including Marble, used for game scenes and robot training. Fei-Fei Li, the Stanford researcher behind the ImageNet dataset, becomes AMD's chief scientist reporting to Lisa Su and keeps running World Labs. Nvidia already gives away its Cosmos world models to pull developers onto its chips. AMD had nothing comparable until this deal.