Monday is a containment-and-infrastructure day: the biggest release is a reference design for keeping agents boxed in, and almost everything else is something you could adopt today. Nvidia’s Open Agent Safety Platform — OpenShell running on CPUs, Sentry watching agents off network chips — is framed as the engineering answer to this month’s sandbox escapes, and Cisco, Microsoft, Oracle and CoreWeave are already named on it. The buildable half of the day: AWS’s Apache-2.0 Dogwood policy language for rules about sequences of agent tool calls, DSPy ported to the BEAM as supervised Elixir processes, and Anthropic’s Opus 5.5 migration notes, which are mostly about cache invalidation and cost. Fireworks’ Ember-1 cuts reasoning tokens about 40% on a Kimi K3 base, and four papers cover agent KV serving, the coming memory wall, and an attack that splits one malicious goal across several benign-looking skills.

Agent containment

  • Nvidia ships a reference design for keeping agents contained: the Open Agent Safety Platform — announced Monday as the engineering answer to this month’s sandbox escapes.
    • Two components: OpenShell, which runs on CPUs and caps what an agent can do, and Sentry, which monitors agents on network chips rather than CPUs or GPUs.
    • Nvidia says the design could have prevented OpenAI’s July Hugging Face breach; VP Justin Boitano cites Hugging Face’s report of 17,000+ agents attacking its infrastructure “for days and weeks”.
    • Partners named: Cisco, Microsoft, Oracle, CoreWeave, Dell, HPE, Lenovo, ARM, Intel; Anthropic is working on integrating cloud-managed agents with OpenShell.
    • Some of it is open source, and it is a reference design — partners build the products; Huang’s framing is that agent security is an engineering problem, not a capability one.
    • Flag: no repo or docs link in the announcement, so “could have prevented” is Nvidia’s own claim on a press call with no independent test yet. (CNBC · Techmeme)

Agent frameworks & tooling

  • Dogwood — an Apache-2.0 policy language from AWS for rules about sequences of agent tool calls, not single requests.
    • Cedar decides one request at a time; Dogwood adds when temporal { ... } clauses that look back over recent tool-call events.
    • Operators express “approve before you sell”, “stop using tool B after A”, and rate limits over windows (formerly within 1h).
    • The action schema is generated from the agent’s MCP tools; existing Cedar policies run unchanged, and AWS has shipped Dogwood support inside Bedrock AgentCore Policy.
    • Reference parser, validator and interpreter at github.com/dogwood-policy/dogwood; the language guide walks the full syntax.
    • Flag: first-party AWS announcement; absolute-time windows, liveness and multi-agent orchestration are roadmap, and AWS is not yet accepting contributions. (lobste.rs 2 · aws.amazon.com)
  • Imp — DSPy, ported to the BEAM: typed LM programs with optimizers, running as supervised Elixir processes.
    • Signatures, predict/chain_of_thought/react, GEPA, MIPROv2, SIMBA and few-shot optimizers; the prompt and parser come from the signature.
    • An agent is an OTP process: watchable, stoppable, run ends with its starter, model requests cut to a deadline you set.
    • A tool call that may already have taken effect is reported unknown, never silently retried — the right default for side-effectful tools.
    • Also: MCP tool import, ACP serving to Zed, RLM and CodeAct shapes · MIT, 198 stars, 2,140 commits.
    • Flag: v0.5 is its first Hex release and explicitly experimental — API may change, optimizers “need large-scale benchmarking”; needs Elixir 1.19+ and a C/C++ compiler. (HN 77 · 7c · github.com)
  • Prompting Claude Opus 5.5 — Anthropic’s migration doc for the model’s behaviour changes, and most of it is really about cost and caching.
    • Thinking is always on; default effort drops to medium (Opus 5 defaulted to high) and levels do not translate — re-test against your own evals.
    • Changing the top-level effort between requests invalidates the prompt cache; a per-message effort change (beta) keeps it.
    • Size max_tokens for thinking tokens — 128,000, the maximum, is what Anthropic used for long agentic runs.
    • Injection hardening: wrap pasted text in <pasted_content id="..."> tags carrying one app-generated random id, plus a system-prompt note about them.
    • Flag: first-party guidance with no numbers behind its claims; the tag scheme is plain text and can be imitated, so it is one guardrail, not a fix. (HN 108 · 100c)

Models & research

  • Ember-1 — a Fireworks-built derivative of Kimi K3 that cuts reasoning tokens ~40% while holding quality, served as a Research Preview alongside K3.
    • 50+ training experiments and 200+ evals on Fireworks’ own training platform, no customer data, per the post.
    • Benchmark table: DeepSWE 1.1 75.2% vs K3-max 66.4%, Terminal-Bench 2.1 82.0% vs 80.9%, SWE-bench Verified 92.2% vs 93.2%.
    • Two customer A/B tests on production coding traffic: score 0.751 → 0.753 at 29.9K vs 49.3K output tokens; 71.3% reasoning-token cut, 39% total.
    • Research releases get two-week serverless access, kept permanent on demand; fine-tuning support is launching for customizing it.
    • Flag: every number is vendor-run on Fireworks’ own Specialized Intelligence Index and its own data, and the post is dated Sep 23 — HN surfaced it today; rasbt credits them for saying plainly that it is built on Kimi. (HN 478 · 219c · @rasbt)
  • ActKV: Efficient LLM Agents through Action-Guided KV Cache Management — compresses the KV cache along the axis that matters for agents: the entries that produce the next action.
    • Action-oriented eviction from stable action-access patterns, confidence-driven budget allocation, and page-aware compression as three kernel primitives.
    • Retains 98.53% of full-KV accuracy using 25.98% of peak KV memory on long-trace tasks.
    • 3.97× token throughput and 3.58× task throughput over full-KV.
    • Flag: abstract-level read; no code link, and the comparison is against the authors’ own full-KV baseline. (arXiv 2609.31395 · submitted Sep 25)
  • DynBranch: Speculative Subgraph Reuse for Dynamic Agentic LLM Serving — addresses the “branch-resolution barrier”: downstream work cannot start until the model or user resolves a control-flow branch.
    • It makes an unresolved branch addressable before it resolves, so candidate subgraphs run during resolution and completed results are reused across later requests.
    • A two-level controller admits speculative work only when expected benefit beats the current load price.
    • Sits at the model-API boundary — no changes to agent harnesses or the inference engine.
    • Up to 32% lower mean latency than each workload’s strongest prior system and 46–66% against a no-reuse floor, on four agentic workloads with Qwen3-32B on 4×H200; holds on a single RTX 4090 with Qwen3-8B.
    • Flag: abstract-level read; no code release stated, and “preserving workflow results” is the authors’ own check. (arXiv 2609.31047 · submitted Sep 25)
  • The KV Cache Is the New Memory Wall — a 28-page SoK that puts compression, eviction, paging, caching and tiering on one protocol so their numbers are comparable.
    • For Llama-3-70B in BF16: 140 GB of weights against 80 GB of HBM per accelerator, and one 128k-token sequence adds 42 GB of KV cache.
    • Derives closed-form arithmetic intensity as a decaying function of context length, with per-die bandwidth for H100, B200 and MI300X and the crossover lengths where KV traffic overtakes weight traffic.
    • Central finding is a three-regime structure: below the hardware crossover, KV compression buys almost nothing because weight traffic dominates.
    • Paging and prefix sharing are lossless but fix capacity, not bandwidth; quantization and eviction cut bandwidth, degrading fast below 4-bit.
    • Flag: single-author survey evaluating one method per domain at 128k — it maps the field, it does not validate any single system. (arXiv 2609.30854 · submitted Sep 25)
  • Stealth Apart, Harm Together: Skill Cascading Attacks on Skill-Based Agent Systems — splits one malicious goal across several skills so each looks benign alone; per-skill scanners and runtime monitors miss it (NeurIPS 2026).
    • Worked example: one skill weakens signals of discontinued medications, a second downgrades the drug-interaction severity, a third suppresses the alert.
    • SkillCascade automates the red-teaming; SkillCascade-Bench ships 213 validated cascading cases across systems and domains.
    • Cascades reliably drive harmful behaviour in Claude Code, Codex and OpenClaw across LLM backbones.
    • The gap named is component-level integrity versus system-level safety: defenses have to reason across skills, not per skill.
    • Flag: abstract-level read; the benchmark’s release location is not linked in the abstract. (arXiv 2609.30383 · submitted Sep 24 · NeurIPS 2026)

Policy & provenance

  • Continued: Trump hosts Amodei at a private White House dinner — day 3 of coverage (base specs in the Sep 26 digest).
    • Axios, sourced to people familiar: the dinner was Sunday evening, and Trump personally invited Amodei after he missed last week’s state dinner.
    • OpenAI’s Altman and Google’s Pichai flanked Trump at that state dinner; Amodei was the notable absence, citing a scheduling conflict.
    • Top AI CEOs meet Trump and Speaker Mike Johnson at the White House on Tuesday — Axios frames the dinner as the appetiser.
    • White House line: “America will lead the world in Super Intelligence, while protecting American consumers.”
    • Flag: anonymous-sourced; the page was read directly, and it notes earlier advice that “Dario’s a little too weird” for Trump. (Axios · Techmeme)
All gathered items - what was cut and why (14)