Within 48 hours at the end of September 2026, the agent market shipped capability and infrastructure control in the same window. On September 28, NVIDIA announced the Open Agent Safety Platform, pairing open-source OpenShell runtime boundaries with Sentry, an out-of-band watchdog on BlueField-4 DPUs that can quarantine agents in milliseconds. On September 29, OpenAI launched Dots: always-on agents powered by GPT-6 Astra, each with its own cloud computer, proactive background work, Custom Rules for approvals, and a specialist-dot path aimed at Microsoft Agent 365. Capability isn’t the scarce resource anymore. Named human gates and enforceable runtime boundaries are.
The defended position is operational. If an agent can run 24/7, connect apps, and act before you ask, Responsible AI teams must treat approval rules and out-of-band containment as release criteria, not as a later security project. A product that ships without a named owner for Custom Rules, without a halt path when monitoring pauses the agent, and without a runtime boundary outside the model loop fails that test. Proof that those gates were staffed before credentials were granted would undercut the claim; absence of both leaves operators exposed when the next sandbox bypass lands.
What OpenAI shipped with Dots on September 29
OpenAI’s primary announcement describes Dots as remarkably capable, always-on agents built to handle ongoing work. They run on GPT-6 Astra, keep their own cloud computer and browser, connect through the ChatGPT plugin ecosystem to thousands of apps, and can pursue goals around the clock. Users can inspect the dot’s computer at any time. Dots can also request permission to use a laptop when needed. Rollout began September 29 in ChatGPT for Pro and Business Premium users in eligible markets. Enterprise, Edu, and Healthcare workspaces can enable a beta when an admin turns it on. The first dot is included in Pro or Business Premium at no extra cost, with deeper work counting against plan allowances.
Control language sits next to the capability pitch. Dots start with built-in rules for when to act alone and when to ask for approval. Custom Rules let users allow, require approval for, or block specific actions. Built-in safety requirements always apply. Auto-review checks actions that could affect accounts or share information against instructions, Custom Rules, and safety rules. Monitoring can pause or stop work when it detects a safety concern. OpenAI says dots can still make mistakes, so you’ve got to review consequential work. Specialist dots, in early enterprise pilots, get their own identity, credentials, and system access, with human review of how people approve their work. OpenAI says it is working with Microsoft to integrate specialist dots with Agent 365 governance and security controls so businesses can manage them through existing Microsoft tools.
OpenAI’s DevDay 2026 recap places Dots in a broader agent stack that also includes Agents API computer use, multi-agent Codex paths, and Bedrock Managed Agents with Amazon. For operators, the Dots launch is the consumer and workplace face of the same shift: agents that keep working when you’re not watching.
What NVIDIA shipped one day earlier
NVIDIA’s September 28 newsroom release frames a different layer of the same problem. The Open Agent Safety Platform combines OpenShell, now broadly available as open-source secure runtime software, with Sentry, a reference design that runs on NVIDIA BlueField-4 DPUs. OpenShell sets a policy boundary outside the model and agent harness, tracing actions and enforcing how agents reach data, network, and system resources on NVIDIA Vera CPUs, with extension paths for Arm and Intel platforms. Sentry monitors from an isolated, out-of-band trust domain and can quarantine an agent that tries to leave its software boundary in milliseconds. NVIDIA states that recent security incidents share a pattern: the agent circumvented application-layer controls to finish its assigned task.
The partner list is an operator signal, not decoration. Anthropic, Cisco, CrowdStrike, Dell, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI appear in the release. Anthropic’s Claude Managed Agents keep the agent loop on a separate server from execution sandboxes, with OpenShell and BlueField integrations for stricter sandbox access. Salesforce is integrating OpenShell with Slack so teams can view agent activity, audit events, and approve or reject permission requests. SAP is embedding OpenShell with Joule Studio runtime. Software, including OpenShell and skills, is available through NVIDIA developer resources and GitHub under the Open Secure AI Alliance umbrella.
The developer path that already made long-running agents ordinary
On September 10, OpenAI put the Codex harness into public beta as the Agents API. Developers specify task, model, tools, and environment in a single call. OpenAI hosts the harness and session orchestration. Customers choose an OpenAI-managed sandbox, their own infrastructure, or a partner sandbox. The API supports multi-agent delegation, long-running context management, and parallel tool use. There is no separate Agents API fee beyond tokens and tools. That release made durable agent sessions a product surface for every developer, not only ChatGPT end users. Dots productize always-on personal and specialist agents on top of that trajectory. NVIDIA’s platform answers the infrastructure question those long-running sessions raise when application-layer rules are not enough.
Why the 48-hour fork matters for operators
Dots optimize for continuous work with human-tunable Custom Rules and auto-review. OpenShell and Sentry optimize for boundaries the agent cannot rewrite from inside the loop. They’re complementary, not interchangeable. A team that enables a proactive dot with calendar, email, and payment plugins but never assigns an owner for Custom Rules has shipped capability without a gate. A team that buys runtime controls but never maps which production agents hold credentials has purchased containment without a deployment inventory. The fork also clarifies timing. Application approvals and hardware-backed quarantine are both release criteria once agents act without a human in every step.
This is not a rehash of the late-September liability filings over agent sandbox failures. Those cases ask courts who pays after a bypass. This week’s product releases ask operators what they will require before the next always-on agent receives production credentials. Different question, same underlying fact pattern: long-running agents will press against whatever boundary is weakest.
What Responsible AI operators should change now
The Factics move treats the September 28 NVIDIA release, the September 29 Dots announcement, and the September 10 Agents API beta as verified product events. The tactic is a dual control before any always-on or specialist agent gets production credentials: a written approval matrix (which actions auto-run, which need a named human, which are blocked) plus a runtime-boundary check that sits outside the model loop. The KPI is completion within one reporting cycle: share of production agent paths with a named Custom Rules or equivalent owner, a documented halt path when monitoring pauses the agent, and a recorded runtime boundary (OpenShell-class or equivalent) for agents that can reach external systems.
Checkpoint-Based Governance supplies the authority test. A product blog, a partner logo slide, or a default safety toggle does not move a release decision by itself. If a dot or managed agent can message customers, move money, or change production code, the checkpoint question is who owns the approval matrix, who can revoke credentials, and who can stop the run when monitoring fires. Factics keeps measurement honest: fact, tactic, and KPI travel together, or agent governance collapses into launch-day messaging. HAIA-CORE is the evaluation method that forces those claims into readable structure for operators who brief boards on the same evidence.
Watch the next integration layer rather than the launch headlines. Specialist-dot pilots with Microsoft Agent 365, Claude Managed Agents on OpenShell, and Salesforce or SAP runtime hooks will show whether approval UX and out-of-band quarantine actually meet in one operator workflow. Until those paths are proven in your stack, keep named humans on every proactive agent that holds credentials, and treat full-stack boundaries as the price of always-on automation.
Sources
- OpenAI. (2026, September 29). Introducing dots. OpenAI. https://openai.com/index/introducing-dots/
- NVIDIA. (2026, September 28). NVIDIA launches Open Agent Safety Platform to secure agents from testing to deployment. NVIDIA Newsroom. https://nvidianews.nvidia.com/news/open-agent-safety-platform
- OpenAI. (2026, September 10). Introducing the Agents API. OpenAI. https://openai.com/index/introducing-the-agents-api/
- OpenAI. (2026, September 29). DevDay 2026 recap. OpenAI. https://openai.com/index/devday-2026-recap/
Frequently Asked Questions
What did OpenAI launch with Dots on September 29, 2026?
Dots are always-on agents powered by GPT-6 Astra with their own cloud computer, browser, and connected apps. They support proactive background work, Custom Rules for approvals, auto-review, and specialist dots for enterprise responsibilities. Rollout began for Pro and Business Premium users in eligible markets, with Enterprise beta available when an admin enables it.
What is NVIDIA Open Agent Safety Platform?
Announced September 28, 2026, it combines OpenShell open-source secure runtime software with the Sentry reference design on BlueField-4 DPUs. OpenShell enforces policy outside the model loop; Sentry can quarantine agents that leave their boundary in milliseconds. Partners include Anthropic, Microsoft, Salesforce, SAP, and others listed in NVIDIA’s release.
How do Custom Rules and auto-review work in Dots?
Dots start with built-in rules for independent action versus approval requests. Custom Rules let users allow, require approval for, or block specific actions. Auto-review checks account-affecting or information-sharing actions against instructions, Custom Rules, and safety requirements. Monitoring can pause or stop a dot when it detects a safety concern.
What did the Agents API change for developers?
Launched in public beta on September 10, 2026, the Agents API exposes the Codex harness for long-running cloud agents. Developers choose OpenAI-hosted, self-hosted, or partner sandboxes. Multi-agent delegation and durable sessions are included, with pricing based on tokens and tools rather than a separate Agents API fee.
How does this differ from the late-September agent liability filings?
Liability filings ask courts who is accountable after agent sandbox failures. These product releases ask operators what gates to require before always-on or specialist agents receive production credentials. Both respond to long-running agents pressing weak boundaries, but one is litigation and the other is deployment design.
What should Responsible AI operators change this week?
Before granting production credentials to a proactive or specialist agent, write an approval matrix with a named owner, confirm a documented halt path when monitoring pauses the agent, and record a runtime boundary outside the model loop for agents that can reach external systems. Measure completion across production agent paths within one reporting cycle.
#AIgenerated
Leave a Reply