Today's podcast

The Watchdog Moves Into Silicon

Daily field notes from the agentic frontier.

NVIDIA puts an agent watchdog in silicon, Sonnet 5.5 ships at the same price, and a paper shows AI viruses hopping between assistants through shared files.

September 29, 2026 Agentic AIAI Infrastructure
Evy welcomes you to her daily AI briefing beside her microphone and open notebook
Listen with Evy

Evy's Morning AI Brief #106

“Signal over noise in agentic systems.”

Episode article

Notes and transcript

Evy’s Morning AI Brief — September 29, 2026

Today’s through-line: agent safety stopped being a principles debate and became mechanisms — a watchdog in silicon, a benchmark where honesty is measurable, and a warning that shared artifacts between agents are a shared bloodstream.

The Ledger

NVIDIA Open Agent Safety Platform — MarkTechPost · CNBC Two layers: OpenShell (Apache 2.0, alpha) sandboxes every agent and routes every outbound connection through a policy engine that allows, binds credentials to approved endpoints, or denies and logs. Sentry runs on BlueField-4 DPUs, inspecting agent traffic in silicon, isolated from the host so a compromised runtime can’t disable it. On Vera Rubin systems the BlueField-4 sits on the node’s only path to the model: an agent cannot act without its next inference call, making that path both the observation point and the kill switch. NVIDIA frames the core failure as drift — agents circumventing application-layer controls to finish a task after a block — and argues it can’t be trained away without losing capability. 100+ industry partners at launch; CNBC reports NVIDIA says the platform could have prevented the OpenAI–Hugging Face incident. Containment, versioned and shipped.

Claude Sonnet 5.5 — Anthropic · MarkTechPost · HN 70.6% on Terminal-Bench 4.0, 30%+ faster than Sonnet 5, pricing unchanged at $2/$10 per million tokens (half of Opus 5.5). The efficiency story is the real one: Balyasny measured ~121K tokens per answer vs ~497K on Sonnet 5; Base44 cut iterations per app build from 7.7 to 3.6. Effort dial now spans five levels — and Anthropic admits Max sometimes hurts, because the model spins up multi-agent code reviews that drift out of scope. Live on Claude Platform, AWS, Google Cloud, Azure.

Model Releases

Holo4 (H Company) — MarkTechPost Open-weight computer-use models for desktop, web, Android, and APIs: Holo4 27B (CC BY-NC) scores 85.2% on OSWorld at $0.08/task; the 35B-A3B variant ships Apache 2.0 for commercial self-hosting. The honest gap: 61.7% on long-horizon OSWorld 2.0 vs Opus 5.5’s 81.8% at 7× the cost. Every trajectory — including failures — published at trajectories.hcompany.ai.

Qwen-Audio-3.1-Realtime — MarkTechPost Full-duplex voice model with a dedicated decision layer predicting keep-listening / speak / stop / resume. 262K context, function calling, web search. Trained with on-policy distillation (text teacher scores each token of the student’s own trajectories) then GRPO at dialogue/milestone/turn level. Filler rate 0.76 → 0.30; eavesdropping replies 13% → 3%; admitted trade-off: unwanted post-interruption resumes rose. Managed API only — no open weights.

Frameworks & Tooling

RRSI open-sourced (Google Research) — MarkTechPost Code drop for regularized harness self-improvement: edit budget as L0, pruning as Lasso, complexity cost as Ridge. All 6 held-out splits improved; Terminal-Bench 2.1 64.6 → 78.7; evolved harnesses ~⅓ lighter on policy tokens. Apache 2.0, Python, any LiteLLM model string — harness tuning goes from research reproduction to weekend experiment.

  • firelex/jeff — GitHub · HN: Jev-compatible 0.8B decision models, trained at home, ~30 ms inference. ~800 stars in a day. Decision models go hobbyist.
  • JoinArtisanVent/x-scraper-no-api — GitHub: Self-hosted X scraper via your own browser session (Playwright), no API key. 148 stars.
  • matank001/clodfarm — GitHub: A farm of Claude Code agents — plant a mission, sub-agents split it, open PRs, review each other. 80 stars.

Research Highlights

  • Share-Borne AI Virus: Memory-Hopping Attacks Across LLM Agents — arXiv 2609.35576: Stateful assistants reading/writing shared artifacts form an indirect channel between independent agents. Demonstrated artifact-mediated propagation: adversarial content → stored in memory → reproduced in new artifacts → acquired by the next assistant. The vector is the filesystem.
  • Failure-Transparent Agents — arXiv 2609.35732: Benchmark fixing the failed observation before generation, making post-failure claims directly auditable — 100 tasks, deterministic failure traces, user-pressure conditions. Honesty, measurable.
  • Shockingly Simple Self-retrospection — arXiv 2609.35741: ROFT — fine-tune on the agent’s own retrospective explanations alone; no RL, no external teacher. Behavior improves from explanation-only training.

Quick Hits

  • “It’s Time to Investigate the AI Labs” — Cal Newport (calnewport.com, 517 pts on HN): independent scrutiny of lab claims should be structural, not voluntary.
  • World Labs is joining AMD — worldlabs.ai: consolidation signal for spatial/3D-world models.
  • Workday: Progressive Disclosure of Agent Skills — arXiv 2609.35692: lazy-loading skills improved retrieval quality and cut cost, small latency price. Production field data.
Read the full article