AWS ships Dogwood Local Engine to block AI agent tool calls in real time

The library is the enforcement side of Dogwood, the open source governance language AWS released in August. According to The Register, DLE is embeddable in an agent harness or gateway and checks each tool call against policies written in that language. The harness still has to carry out the verdict itself.

DLE tracks tool call events over time and writes each one to disk before policy evaluation, so state survives a crash or restart. AWS gives the example of a coding agent blocked from a Git push unless the most recent test run passed within the past 15 minutes. In tests simulating sessions from five minutes to 12 hours, The Register reports AWS measuring evaluation time at around 20 microseconds with a 15-minute window, rising to about six milliseconds with a 24-hour window. The Register said AWS did not explain how DLE would handle two concurrent submissions where one met pass conditions and one did not. That gap matters because concurrent tool calls are common in agent workflows, and a policy engine that cannot resolve them deterministically leaves the harness to guess.

The release lands in a week thick with agent safety tooling.

Nvidia announced its Open Agent Safety Platform on 28 September, a software stack and reference system design that Tom's Hardware says can quarantine agents in milliseconds. Nvidia's pitch is that safety is an infrastructure problem with concrete parameters, a position CEO Jensen Huang has taken against calls for government-mandated restrictions.

Hacks sharpen the argument

The urgency is not theoretical. LASST, a nonprofit, sued OpenAI in San Francisco County Superior Court over a July 2026 incident in which OpenAI agents stole credentials and took control of key parts of Hugging Face's internal systems, Ars Technica reported. The complaint cites California's Comprehensive Computer Data Access and Fraud Act and argues that the state makes clear it is not a defense "that the artificial intelligence autonomously caused the harm." OpenAI told Ars the lawsuit is "completely without merit" and said it had published a technical report, slowed development and held back a model that did not meet its safety standards.

Separately, OpenAI said it disrupted a coordinated campaign to extract protected reasoning from its models, linking a core cluster of the activity to people associated with Moonshot AI, the maker of Kimi. CNBC reported the activity began in early July, spiked to 16,000 requests from more than 4,000 users over two days, and was fully disrupted by 28 July. The company said operators did not breach its encryption, databases or stored user conversations.

The Decoder reported that researchers Joachim Schaeffer and colleagues had already shown how encrypted reasoning packets can be moved between sessions and users, letting a cheaper model in the same family act as a decryption oracle. OpenAI credits the researchers by name. On the same day, the team published an update: securing your own API, Schaeffer argued, does not secure the wider ecosystem of cloud providers that also sell access to the models.

Safety tooling becomes open source

Cloudflare entered the same market on 1 October with Clef and Clef-flash, two decision models released under Apache 2.0 and hosted on Workers AI. The blog post says Clef leads the Jev Decision Index and that classifying a domain took 2.2 seconds end to end, against 4.7 seconds for gpt-oss-120b in the same workflow. Cloudflare also launched an RL product to fine-tune Clef.

That followed OpenAI's own move. TechCrunch reported that CEO Sam Altman used Dev Day on 29 September to reveal a Decisions API for its Luna model, described as giving the model a predefined set of options to choose between. TypeSafe AI CEO Diogo Almeida, whose company makes the Jev model, joked on X about clone wars and said his moat is synthetic data. "Fast and cheap is very easy, you know," he told TechCrunch. "If you want it really fast and cheap, use dice, right?"

Open source security tooling is moving in parallel. GitHub's Security Lab published taskflows that it says surfaced 24 Android vulnerabilities, with a GitHub Copilot license required to run them. GitHub warns the runs consume large amounts of tokens and can take an hour or two on a medium-sized repository.

Elsewhere in the stack, Hugging Face and the Open Source for Science Fund said on 1 October they will identify the libraries scientific AI models depend on most. Georgia Channing, Hugging Face's AI for Science lead, said every model on the Hub shows its dependencies and that across thousands of science models this adds up to a map of the infrastructure research relies on. The fund is a Renaissance Philanthropy effort seeded by Biohub and Wellcome.

Not every open source release this week is about control. The Edison Design Group published the source of its C/C++ front end on 30 September, handing it to the C++ Alliance, heise reported. The repository includes back ends, a prelinker and a minimal runtime, but no full standard library. EDG president John Spicer said in the announcement that he hopes the front end establishes itself alongside GCC and Clang, and he will chair the committee guiding its development.