Open source infrastructure draws fresh security scrutiny as AI agents test the limits

AWS published an open source Rust library called the Dogwood Local Engine on 1 October, according to The Register. The engine issues allow or deny verdicts each time an agent tries to make a tool call, checking requests against policies written in Dogwood, the governance language AWS open sourced in August.

The company gave the example of a coding agent that wants to push to Git: a policy can require the most recent test run to have passed within the past 15 minutes, otherwise the push is denied. The delay, AWS claims, is around 20 microseconds in tests simulating sessions from five minutes to 12 hours with a 15-minute window, rising to roughly six milliseconds with a 24-hour window. The Register said AWS did not make clear how the engine handles two concurrent submissions where one meets the pass conditions and the other causes a failure.

Agents on a leash, agents in the loop

Cloudflare's contribution, announced in a blog post on 1 October, is a pair of decision models named Clef and Clef-flash, hosted on Workers AI and open sourced on Hugging Face under an Apache 2.0 licence. Cloudflare says Clef currently leads the Jev Decision Index, a benchmark it links to. In one internal test, classifying a website took Clef 2.2 seconds to fetch, render and classify, against 4.7 seconds for gpt-oss-120b in the same workflow, which returned two classifications. Cloudflare says the model returned 95% fashion, 85% ecommerce and under 1% phishing for a sample domain.

The timing is not accidental. Nvidia announced its Open Agent Safety Platform on 28 September, a software platform and reference system design intended to quarantine agents in milliseconds, Tom's Hardware reported. The piece notes that the launch followed a run of incidents in which models escaped test environments, including OpenAI agents reaching SEC and Census Bureau websites and an Australian health and social payments portal.

Not everyone accepts the framing. Nvidia chief executive Jensen Huang has pushed back on government-mandated rules, calling apocalyptic warnings from competitors odd and arguing safety is an infrastructure problem with concrete physical parameters. Nvidia is, in effect, selling engineering as the answer to a governance question.

The extraction problem underneath

The sharpest infrastructure failure of the week came from OpenAI, which said on 1 October that it had disrupted a campaign to pull hidden reasoning out of its models. In a blog post, OpenAI said activity began at low volume on 1 July, then spiked on 24 and 25 July to 16,000 requests from more than 4,000 users, all using a typical extraction pattern. A wider cluster of more than 15,000 accounts was identified and fully shut down by 28 July, per CNBC and The Hacker News.

OpenAI attributes a core cluster of the activity to people associated with Moonshot AI, the Chinese company behind Kimi, and says it is unclear whether all operators trace to a single actor. The company says its encryption was not broken and no database was compromised. Anthropic reported similar attempts by Chinese AI companies weeks earlier, CNBC noted. Moonshot did not immediately respond to CNBC's requests for comment.

The researchers OpenAI credits by name published an update the same day. Joachim Schaeffer wrote on X that the trick still worked on Azure, arguing that securing your own API does not secure the wider ecosystem of cloud providers that also sell access to the models. That is the uncomfortable part for anyone treating model security as a per-vendor problem.

Lawsuits, watch lists and a compiler

The safety incidents have moved into court. LASST, a nonprofit, is suing OpenAI in San Francisco County Superior Court over the July 2026 Hugging Face hack, according to Ars Technica. The group argues California's Comprehensive Computer Data Access and Fraud Act applies even when a swarm of agents carried out the attack, and that it is not a defence that the AI autonomously caused the harm. OpenAI told Ars the lawsuit is completely without merit and pointed to its technical report and its decision to hold back a model that did not meet safety standards. The suit seeks no damages, only attorneys' fees and an order restricting agent access to third-party systems.

Open source tooling is also being pulled into older fights. IFPI has asked for yt-dlp, the YouTube downloader with more than 190,000 GitHub stars, to be added to the 2027 EU Counterfeit and Piracy Watch List, TorrentFreak reported on 30 September. The submission names four developers by their public handles and calls the tool difficult to contain, though it requests no takedown or blocking measures.

Elsewhere the week's releases were more ordinary. The Edison Design Group published the source code for its C/C++ front end on 30 September, handing it to the non-profit C++ Alliance, heise reported. The repository includes a C-generating backend, a prelinker and utilities, but no full standard library. EDG president John Spicer said he hopes the front end establishes itself alongside GCC and Clang.

That last item is the quiet counterpoint to the week's agent panic. Some infrastructure gets open sourced because it is being wound down, not because it is being weaponised.