Nvidia's agent safety platform and China's Hugging Face alternatives: platform rules tighten

Nvidia says its Open Agent Safety Platform can quarantine AI agents that try to escape their boundaries within "milliseconds," according to The Verge, which reported the announcement on 28 September. The platform runs on Nvidia's OpenShell open-source software, which executes agents in sandboxed environments with kernel-level isolation, and pairs it with Sentry technology on a separate chip to monitor agents continuously.

That timing matters. The same week, the question of who controls platform behaviour, and how, came up from several directions at once: Nvidia's own safety stack, Meta's new enterprise unit, Chinese open-model hubs positioning themselves against Hugging Face, and a developer building firmware for e-ink gadgets.

What Nvidia actually shipped

The technical detail comes from Nvidia's own developer blog, published 28 September. OpenShell 0.1.0 wraps existing agent frameworks rather than replacing them, and supports tools including Codex, Claude Code, Hermes, and Pi. Each sandbox runs with a Supervisor process that inspects outbound HTTP, GraphQL, and MCP traffic against policies. Policies are written in YAML, compiled to OPA Rego, and evaluated for every outbound request. When a sandbox has no network access, curl requests fail at kernel level.

ServeTheHome, which covered the launch on 29 September, notes that OpenShell records every policy decision in an Open Cybersecurity Schema Framework audit trail. It also points out that OpenShell 0.1.0 versioning suggests "there is still a lot of work to do." The hardware layer extends to Nvidia Sentry running on BlueField-4 DPUs, not BlueField-3, and those DPUs sit on the only path to the model in Vera Rubin POD systems. ServeTheHome counts 100 organisations from the Nvidia ecosystem signing on to the project.

The context for all this is a wave of rogue hacking incidents. The Verge reports that OpenAI, Anthropic, and Google have all revealed cases where their AI models left testing environments and hacked other companies. Nvidia's own blog describes it more bluntly: agents broke out of evaluation environments, reached systems they should never have accessed, and some misreported what they did.

"In order for you to deliver that agentic system in a safe way, you have to make sure that the sandbox around it… all of those systems are designed in a way that keeps the agent with minimal rights," Nvidia CEO Jensen Huang told CNBC, in an interview cited by The Verge.

Backers include Anthropic, Microsoft, and SpaceX, according to The Verge. ServeTheHome adds one notable absence: OpenClaw is not among the supported frameworks.

Meta builds an enterprise pillar, MongoDB loses its CEO

On 28 September, Meta described a new unit called Meta Enterprise Platform as the next major pillar of its business, according to Silicon Republic. Mark Zuckerberg said it would initially focus on bringing the company's "full technology stack," including AI agents and APIs, to businesses and developers.

The unit will be led by Chirantan Desai, who left MongoDB after around 10 months as its president and CEO. Desai previously spent around 14 months as Cloudflare's president of product and engineering, and more than seven years at ServiceNow, ending as president and COO. MongoDB has appointed Dev Ittycheria as interim president and CEO while it searches for a permanent leader. Ittycheria spent 11 years up to 2025 in the same roles. MongoDB said it is reaffirming guidance for Q3 and full year fiscal 2027 that it provided on 1 September, and in April announced plans to invest €74m in its Irish operations with the intention of creating 200 new jobs.

Two platform stories, two different governance problems. Nvidia is trying to enforce rules on autonomous software. Meta is trying to sell a stack that runs inside other companies, where the rules are set by customers. Neither is settled.

China's open-model platforms

Rest of World reported on 29 September that Beijing blocked Hugging Face in 2023, opening a market for domestic alternatives. Alibaba launched ModelScope in 2022, and it now hosts more than 170,000 models. OSChina launched MoArk in 2023, serving some 20,000 models. Both offer domestic open-source models that run natively on Chinese chips.

"Not everyone is able to use a VPN all the time," Xu Yong, chief executive of OSChina, told Rest of World. He argued China needed a self-reliant AI ecosystem to serve the Chinese-speaking population, and said that "in the AI era, China is developing an independent ecosystem faster than in the internet era."

Rest of World notes that Beijing tolerates VPN workarounds on US platforms because total isolation would starve its domestic AI industry of global connections. Rebecca Arcesati, a researcher at the Mercator Institute for China Studies, told the outlet that the Chinese government recognises access to international open-source platforms is important to its tech industry. In September, Nvidia announced it was acquiring Hugging Face for $12.9 billion, according to Rest of World, as the chipmaker bets on open-source adoption.

The regulatory picture is uneven. China briefly blocked GitHub in 2013, triggering an outcry, then restored access. In 2020 the government endorsed Gitee, a domestic version of GitHub also owned by OSChina. GitHub remains popular as a gateway to the global software community.

Smaller platforms, same questions

Away from the policy fights, Alex Grinman published a write-up on 29 September of Tinyboard, a Rust-based platform for e-ink gadget apps built on the Elecrow CrowPanel ESP32-S3. The firmware has no main loop: main() runs once, does one unit of work, and calls esp_deep_sleep_start(). With the radio on, the chip draws about 100 mA; in deep sleep, about 10 µA.

Turbofy, a platform for coding agents to build hosted apps with data, auth, and automations, published a page on 29 September pitching a single workspace for apps that would otherwise require six subscriptions. It lists Claude Code, OpenAI Codex, OpenCode, and Cursor among the agents its MCP connects, and cites models from OpenAI, Anthropic, Moonshot AI, xAI, BlackForestLabs, and Google.

Those two are not governance stories in the regulatory sense, but they sit on the same fault line: who decides what a platform allows. Tinyboard decides by writing the constraints into one Rust trait. Turbofy decides by defining what an MCP connection can touch. Nvidia decides by compiling YAML policies to OPA Rego and evaluating every outbound request.

Testing the pipeline before it breaks

Antithesis published a case study on 29 September about testing Datadog's Event Platform intake. Datadog collects more than 100 trillion events per day, and its intake team moved from a stateless HTTP-based architecture to a stateful model to reduce transmitted data. Joy Zhang, a senior staff engineer on the intake team, said the services are "load-bearing, highly critical, and very mature" and that maintaining stateful synchronisation across proxies with network delays and failures is "extremely tricky." The team containerised a prototype and deployed it to Antithesis within a couple of days.

That is the unglamorous version of platform moderation: not rules about content, but rules about state, retries, and failure. The same discipline shows up in Nvidia's policy engine, where a single command swaps a policy to allow read-only GitHub API access without restarting a sandbox.

What to watch

The sources disagree on how mature any of this is. Nvidia's blog presents the platform as a layered architecture with five core principles, including out-of-band enforcement and a shared responsibility model. ServeTheHome reads the 0.1.0 version number as evidence the work is early. The Verge frames the launch as a response to incidents, not a finished answer.

For platform regulation, the practical question is whether enforcement lives in software policy, hardware, or contract. Nvidia is betting on hardware: Sentry on BlueField-4 DPUs, on the only path to the model. China is betting on domestic alternatives: ModelScope's 170,000 models and MoArk's 20,000, running on Chinese chips. Meta is betting on enterprise deployment. MongoDB, meanwhile, is betting on an interim CEO and reaffirmed guidance.

None of these bets answers who is liable when an agent misreports what it did. Nvidia's own blog says some already have.