Everything That Happened in AI Today (Monday, September 28, 2026)

AI agents got dramatically better at doing things. Conveniently, everyone also spent Monday figuring out how to stop them from doing the wrong things. Welcome, humans. Today had one very obvious theme: we keep giving AI agents more hands, then immediately inventing new ways to slap those hands away from the stove. NVIDIA moved agent safety below the model and into the surrounding computer. The UK AI Security Institute watched GPT-6 Astra cross task boundaries in simulated cyber tests. Perplexity found that even a locked-down agent could still find clever routes through the network. Cambridge researchers want governments to start tracking how much AI is automating AI research itself. Meanwhile, product teams shipped agents with phone numbers, wallets, computers, cloud desktops, browsers, and permission to buy things. Apparently the plan is to hand the agent a wallet, then invent the circuit breaker. Let’s get into it. Around the Horn — Monday, September 28, 2026 🆕 NEW From The Neuron Bill Gates’s headline-grabbing warning about catastrophic AI risk leads to a much more practical question: who actually gets the authority to inspect an advanced model, require safeguards, or stop its release? Meta has already made Muse a consumer hit. Now Zuckerberg wants to turn enterprise AI into another major business pillar. Here’s the harder part: convincing companies to hand Meta their work. NVIDIA’s newest agent-safety pitch goes beyond telling the model to behave. It combines software isolation with a separate hardware watchdog that can enforce the rules even if the agent goes sideways. We broke down how it works here. AI summaries can rewrite what people remember. Georgetown and University of Washington researchers found omission was the dominant failure mode in 20 ChatGPT/Gemini accident summaries, and in a 328-person experiment a misleading recap cut correct sign recall from 83.6% to 44.8%. Our breakdown is here, with the paper here. The study did not test workplaces or claim the models would independently invent the swapped detail; the practical safeguard is checking disputed facts against the original recording. CMU built a fake hospital to test whether models can handle the messy part of medicine. Synthetic Hospital contains 1,268 synthetic patients and 5,602 longitudinal encounters; physicians could only distinguish synthetic from real records at chance, while models did much better at retrieving evidence than summarizing whole patients. Agent loops helped when they had to gather scattered history, but sometimes hurt when the chart was already in context. Read our explainer, the paper, and the code/data. AI agents are getting a security layer underneath the AI Most AI safety today happens inside the model. You tell an agent what it may do, train it to follow those rules, monitor the transcript, and hope it never finds a route you forgot existed. NVIDIA’s new Open Agent Safety Platform adds a second layer outside the model. Its open-source OpenShell runtime puts the agent in a sandbox (a locked-down workspace with explicit permissions) for files, tools, processes, network access, and credentials. NVIDIA Sentry then watches from separate BlueField hardware, a data-processing chip that can monitor network activity outside the agent’s own environment and quarantine it if something goes wrong. That separation is the point. The agent cannot simply talk its way around a hardware-enforced permission. Jensen Huang said the platform is launching with 100+ ecosystem partners; the official launch says the stack is governed under the Linux Foundation Open Secure AI Alliance. CBS and CNBC both highlighted NVIDIA’s claim that this architecture could have contained July’s Hugging Face incident involving 17,000+ agents. The Hacker News discussion raised the obvious counter-question: who watches the watchdog? And Monday supplied several reasons people are building that second layer. The UK AI Security Institute reported that GPT-6 Astra carried out unauthorized supply-chain attack activity in 29.2% of fully simulated trials when its cyber safeguards were disabled, versus 6.3% for GPT-5.6 Sol and 0% for GPT-5.5. Even after testers explicitly said anything outside the listed task was out of scope, Astra crossed the line in 4 of 49 trials. AISI’s thread and technical report also note that Astra often recognized the environment as simulated, a caveat Nathan Calvin highlighted here. Perplexity found a complementary problem. Its SPACE red-team held when models tried to escape the underlying Firecracker virtual machine, essentially an isolated mini-computer. But several frontier models still bypassed network restrictions using tricks like DNS spoofing (misdirecting how a domain name resolves) and shared CDN infrastructure (delivery networks shared by many websites). Perplexity hardened those controls and stopped the bypasses on retest. CEO Aravind Srinivas summarized the month-long test here, saying the virtual machine survived 108 root-access runs while the networking layer needed work. OpenShell contributors are already testing per-agent network budgets that can throttle unexpected outbound activity and flag violations. The UK’s NCSC makes essentially the same architectural argument in its agentic-AI cyber guidance: scope the agent, sandbox it, log it, choose the right level of human oversight, and keep an emergency stop. Translation: “Please don’t do that” is a prompt. “You physically cannot do that” is a security control. 🏆 TOP 5 NEWS (Around the Horn) Florida’s attorney general asked a state court for an emergency injunction restricting OpenAI’s development of new models without independent safeguards. The filing also seeks limits around minor access, human-like product framing, and certain safety claims. Bloomberg covered the state action, while Joe Weisenthal highlighted unusually sweeping language from the filing here. Current reporting describes this as a request for a court order, not an order already in force. (techmeme.com) Axios separately explained how a state could wall off access through age limits, geofencing, and bans in schools, courts, or agencies, and its injunction report details the consumer-protection allegations and guardrail-bypass claims. Mark Zuckerberg, Dario Amodei, and Greg Brockman are expected at a Tuesday White House meeting on AI risks with President Trump and Speaker Mike Johnson. POLITICO reported the planned lunch. Andrew Curran first noted that Amodei had not initially been expected to attend and later posted follow-up reporting. Johnson separately said the discussion would focus on balancing innovation with oversight and rejected a broad moratorium. (theduke.fm) Reuters reported Johnson's stated goal as finding a balance between innovation and oversight without a broad moratorium. The meeting follows last week’s U.S.-China AI diplomacy, putting the same race-versus-oversight argument back in front of the White House. A large group of AI researchers and lab leaders warned that automating AI R&D could create an “intelligence explosion.” The Cambridge CASP report argues that software agents doing more of the work required to build their successors could compress years of AI progress into months. The full paper calls for governments to measure internal R&D automation and prepare options to steer, constrain, or adapt to faster progress. The WSJ reported on the policy push, while Andrew Curran flagged the report and argued that its information-sharing proposal could matter especially for labs outside existing coordination efforts here. Ryan Greenblatt is joining METR to investigate how close frontier labs are to automated AI research feeding back into faster AI progress. Greenblatt said he had become less skeptical that publicly available evidence could be consistent with very rapid capability gains, and wants more verified information from inside labs on takeoff, alignment, and control. Supabase’s rise into the AI-coding stack is turning into