At GTC Berlin, NVIDIA unveiled the OpenShell Reference Architecture alongside the Agent Knowledge Foundation within its Agent Toolkit. Addressing critical enterprise vulnerabilities where autonomous tool-using agents succumb to prompt injections, hallucinated destructive commands, or unauthorized data exfiltration, OpenShell establishes hardware-isolated runtime boundaries. Operating through hardware roots of trust, OpenShell dynamically intercepts out-of-boundary tool calls and file access in real time with sub-microsecond latency, establishing an authoritative blueprint for secure, auditable enterprise agent deployments.
Zoom
Key Takeaways
NVIDIA officially launched the OpenShell Reference Architecture at GTC Berlin, establishing hardware-isolated boundaries for autonomous agents
Implements dynamic runtime interception, strictly preventing out-of-boundary tool invocations, malicious script execution, and data leaks
Natively integrates with the NVIDIA Agent Toolkit and Agent Knowledge Foundation for end-to-end access control and compliance auditing
Solves critical enterprise security roadblocks preventing production rollout of high-privilege coding and autonomous operations agents
Researchers from Southern University of Science and Technology (SUSTech) unveiled ActGov (arXiv:2609.24446), a runtime policy-constrained governance framework designed to enforce strict authorization boundaries over LLM agent tool executions. When agents execute multi-step workflows, untrusted web outputs or file contents often trigger indirect prompt injection attacks, exceeding user intent. Rather than relying on fragile LLM-based self-policing, ActGov pairs an iterative SMT-verified policy compiler (ActGov-Policy) with a lightweight runtime validator (ActGov-Runtime). In evaluations across AgentDojo and AgentDyn benchmarks, ActGov near-completely neutralizes prompt injection threats while preserving full task utility, outperforming static guardrails without latency penalties.
Safety researchers have introduced 'Just Ask Jev' alongside the RLCDAlignBench suite (arXiv: 2609.29429, GitHub: sumleo/RLCDAlignBench). Conventional alignment auditors rely on expensive generative LLM judges or rigid single-label classifiers (e.g., Llama Guard). Trained via Reinforcement Learning for Calibrated Decisions (RLCD), Jev evaluates multiple typed alignment questions simultaneously across ten failure modes—sycophancy, jailbreaks, deception, prompt injection, hallucination, privacy breaches, bias, reward hacking, uncertainty concealment, and power seeking—in a single forward pass. Achieving a median 0.886 zero-shot AUROC across 44 benchmarks, Jev matches human consensus while slashing evaluation costs by 63x.
Zoom
Key Takeaways
Evaluates ten distinct alignment failure modes simultaneously with calibrated probability outputs in a single forward pass.
Achieves a 0.886 median AUROC in zero-shot settings across 44 benchmark suites and five frontier target LLMs on RLCDAlignBench.
Reduces deployment and audit inference expenditure by 63x compared to text-generating LLM-as-a-judge pipelines.
Outperforms supervised domain-specific classification baselines while surfacing subtle labeling defects in legacy datasets.
Full evaluation harness, calibrated inference code, and annotated benchmarks open-sourced on GitHub.
Security and systems researchers have introduced AgentKernel (arXiv: 2609.29647), a trust-native operating system designed specifically for autonomous AI agents. As modern agents routinely ingest untrusted external data and execute privileged tools, traditional application-level guardrails fail to prevent prompt injections, memory poisoning, and tool abuse. AgentKernel establishes a mandatory, non-bypassable OS substrate structured around four architectural pillars—Identity, Perception, Cognition, and Execution—bringing deterministic capability confinement and information flow control to the semantic plane.
Zoom
Key Takeaways
Translates classical operating system process isolation and privilege rings into the semantic LLM plane.
Structures security across four pillars: kernel-governed identity, graduated perception, information-flow-controlled memory, and semantic execution gates.
Eradicates persistent memory poisoning and unauthorized shell tool escalation caused by indirect prompt injection.
Achieves a 99.1% containment rate against red-team attack vectors while constraining runtime latency overhead to 3.2%.
Preprint, architecture specifications, and security proofs published openly on arXiv and Hugging Face.
Gemini CLI’s stable channel moved to v0.61.0 on 2026-09-23 (npm @google/[email protected]), bringing indirect prompt-injection defenses, hardened sandbox filesystem boundaries and isolated runtime state, AgentLoopContext preservation across object spreads, and correct handling of explicit versioned Flash model IDs.
Zoom
Key Takeaways
Install stable with npm install -g @google/gemini-cli (now 0.61.0); preview/nightly remain separate tags
Blocks indirect prompt injection via build-file edits and untrusted flags (#29250)
Hardens sandbox filesystem boundaries and isolates runtime state (#29214)
Preserves AgentLoopContext fields across object spreads (#29335)
Keeps explicit versioned Flash model IDs intact during routing (#29252)
Context7 (@Context7AI / Upstash) launched Context7 Search, a grounding API for coding agents. One GET returns official documentation snippets managed by library owners and scanned for prompt injection and malware—safer and more token-efficient than open-web search. Free tier is 1,000 calls/month; Pro is 5,000 per seat/month, then $10 per 1,000 calls.
