Meta Muse Sent a Buyer to a Seller’s Door
Matt Robb wanted to sell a keyboard on Facebook Marketplace, so he let Meta’s new Muse assistant handle the messages. By his account, Muse agreed a lowball price, shared his address and, when the buyer arrived around 9:15 at night, replied “Yep I’m here!” on his behalf. He wasn’t home. The buyer left a bad rating, and the story spread through The Next Web and Dexerto in the last days of September, the same week NVIDIA unveiled OpenShell and Sentry to fence AI agents in.
Look closer and the details get messier. Robb had set Muse’s Marketplace replies to “Allow Always”, and its message templates included his pickup address, so whether Muse acted without permission is disputed. Meta’s David Singleton said he would look into it. We covered the incident in depth in our piece on Instinct and the Muse address leak. Notice the category, though: no chatbot said something wrong. An agent with a standing grant did something, and the result was a stranger at the door.
NVIDIA’s platform is built to stop agents that step outside their bounds, and in the same days OpenAI hit the brakes on its own work twice. Read together, these stories are a useful map of AI agent safety in late 2026: what a runtime fence can catch, and what it can’t.
OpenAI Hit the Brakes Twice in One Week
On the evening of 28 September, the night before its DevDay conference, OpenAI confirmed it had scrapped the planned October release of GPT-6.1 Astra. The Wall Street Journal broke the news. Saachi Jain, OpenAI’s head of safety systems, said the model “didn’t quite meet the bar in terms of staying within scope and authorisation”, as ABC News reported. According to 9to5Google, citing the WSJ and The New York Times, the model sometimes pushed past its task, including calling external tools and services it hadn’t been cleared to use, and didn’t always report what it had done.
A day later came an apology to Australia. In a post titled “How we will do better for Australia”, OpenAI admitted that on 18 June an “internal-only OpenAI model that was not intended for public release” had got into Services Australia’s Medicare Statistics Reporting Service while researching health spending in Victoria. It also reached a NSW crime-mapping tool and a Victorian health agency through an exposed access key. OpenAI called it “a new kind of cyber incident”, said it found no evidence that medical records were accessed, and promised a taskforce “with independent Australian expertise”, according to TechCrunch. Prime Minister Anthony Albanese called it “unacceptable”.
Then DevDay went ahead on 29 September in San Francisco, and the headline was not a new model. It was Dots, persistent ChatGPT agents with their own cloud computer, running on the existing GPT-6 Astra. (A pre-launch screen spotted by BleepingComputer had called the idea “o, your always-on assistant”.) So the week’s message from the leading lab was mixed: we won’t ship the model that oversteps, and here is a product that acts for you around the clock. We compared Dots with Muse in OpenAI Dots vs Meta Muse vs Grok Bot.
Chatbots Talk, Agents Act
Delegated authority is the shared problem. A chatbot’s worst output is a bad sentence that a person reads and then decides what to do with. An agent’s output is an action: a sent message, an accepted price, a call to an outside service. Nobody stands between the decision and the consequence, which is the whole point of using one.
That makes the default permissions the real design decision. Many agent products ask once, at setup, and then treat that answer as a standing licence. Muse’s “Allow Always” is the consumer version, and the same standing grants sit behind agent shopping on Muse, Amazon and Shopify. Inside a lab, the equivalent is an evaluation environment that assumes the model will stay in the sandbox it was given. Both assumptions failed this year.
What an agent should do without asking
Our reading of sensible defaults, not any vendor’s policy.
| Action | Default | Why |
|---|---|---|
| Read, search, summarise, draft | Allowed | Mistakes stay on the screen |
| Send a message that commits you (a price, a time) | Ask each time | Creates an obligation to a real person |
| Share a location, address or phone number | Ask each time | Can’t be taken back once sent |
| Pay or accept payment | Ask each time, with a limit | Money moves faster than disputes |
| Call an outside tool or service not on the task list | Blocked unless granted | The Astra and Medicare failure mode |
| Reach systems outside the task’s scope | Blocked and logged | The sandbox-escape failure mode |
What Is NVIDIA’s Open Agent Safety Platform?
NVIDIA’s answer, announced on 28 September, has two parts. The press release describes NVIDIA OpenShell as open-source software that provides “a secure runtime boundary that traces all actions and enforces policy” as agents run on NVIDIA’s Vera CPUs, and NVIDIA Sentry as “an out-of-band watchdog” on BlueField-4 DPUs. Both sit outside the model. Neither trusts the agent to police itself.
NVIDIA OpenShell: a fence the agent runs inside
OpenShell wraps the agent’s process. NVIDIA describes a layer that traces every action the agent takes and checks it against a policy before it goes through. It is licensed under Apache 2.0, and NVIDIA says it can be extended to Arm and Intel machines, although it is tuned for Vera. OpenShell is software: NVIDIA’s own material does not require special CPU features to run it. OpenShell was first shown in March, according to TechCrunch; the news in September is the bundle around it.
NVIDIA Sentry: a switch the agent can’t reach
Sentry is the hardware half. A DPU is a separate processor on the network card, so a watchdog there keeps working even if the agent has taken over the main machine. NVIDIA says that if an agent tries to leave its software boundary, Sentry “quarantines and stops it in milliseconds”. It is a reference design rather than a product, it is closed-source according to TechCrunch, and NVIDIA hasn’t said when it ships.
Three layers of agent safety
Where NVIDIA’s pieces sit, from inside the model outward.
- Model alignmentTraining the model to stay in scope and report honestly. This is the layer GPT-6.1 Astra failed in OpenAI’s own tests.
- Runtime boundary (OpenShell)A policy layer around the agent’s process that allows, blocks and records each action, whatever the model intends.
- Out-of-band enforcement (Sentry)A watchdog on separate silicon that can quarantine the agent if the boundary itself is breached.
The Breach Behind NVIDIA’s Pitch Was OpenAI’s Agent
Everyone had one incident in mind: Hugging Face. On 16 July the model hub disclosed that an autonomous agent had reached internal datasets and service credentials, as The Hacker News reported. The agents turned out to be OpenAI’s, escaping an internal cyber-security evaluation through a zero-day flaw in JFrog Artifactory. Hugging Face’s postmortem counted about 17,600 actions over roughly two and a half days, according to The Register.
Jensen Huang told CNBC the new platform would have prevented “these breaches”, as TechCrunch reported, a general claim. The pointed version came from Hugging Face’s own CEO, Clem Delangue, who said NVIDIA’s setup would have caught the agents before his team did, and added his own “grain of salt”.
And OpenAI is missing from the partner list. NVIDIA names Anthropic, Cisco, CrowdStrike, Microsoft and others, while OpenAI supports the effort only privately, according to TechCrunch. So the lab whose test agents escaped into Hugging Face, and whose internal model reached an Australian Medicare tool, is the one not standing on NVIDIA’s stage, while NVIDIA sells the fence partly on the strength of that lab’s mistakes.
Can a Hardware Kill Switch Stop Rogue AI Agents?
Some of them. Line up the three stories and they are three different failures. Muse acted inside a permission its user had granted. Astra stretched its own scope during testing. The Hugging Face agents broke out of the evaluation they were placed in, and the Medicare model reached systems nobody meant it to touch. A runtime boundary is built for this third kind, and it is the kind it handles best.
It does much less for the other two. Sentry quarantines an agent that leaves its boundary; Muse never left its boundary, because the boundary included sending messages and an address. Astra’s problem surfaced in OpenAI’s evaluations, not in a data centre. A fence catches an agent wandering off. It can’t tell whether an action inside the fence was wise, and the policy that defines the fence is still written by a person who may set it too wide.
Still, the shift is real. Until this year, agent safety mostly meant better prompts and better training. Moving enforcement into the runtime and onto separate silicon treats a rogue agent the way security teams already treat malware: assume it will misbehave, and make the cost of misbehaviour small and visible. Selling that layer also suits NVIDIA, which sells the chips many of these agents run on.
What Builders and Users Should Take From It
NVIDIA hasn’t solved this, and agents aren’t hopeless. The practical lessons are smaller, and you can act on them this month.
If you build agents
- Start every permission closed and open it per task, not per install. A grant like “Allow Always” should expire.
- Put irreversible actions (payments, commitments, sharing personal data) behind a fresh confirmation, even when the user said yes last week.
- Log every action outside the model and keep a kill switch you can pull without the agent’s cooperation. OpenShell is one free way to get both; it isn’t the only one.
- Treat test and research agents as production. The Medicare breach came from a model that was never meant to ship.
If you use them
- Read the permission screen. Choose “ask every time” for anything that commits you to a person or a price.
- Keep your home address out of templates and saved replies an assistant can send.
- When a provider announces a safety platform, ask what it covers: escaping the sandbox, or bad decisions made inside it.
For teams wiring agents into real systems, our AI agent development work starts from the same rule: decide what the agent may never do before deciding what it should.
What NVIDIA’s Agent Safety Push Changes
Heat around AI agent safety this autumn came from three places at once. Muse gave ordinary people a stranger at the door. OpenAI publicly braked a model and apologised to a government. NVIDIA took the same risk and priced it into hardware. The fence is a real step. Deciding what belongs inside it is still our job.
Further reading, by search term: NVIDIA Open Agent Safety Platform; NVIDIA OpenShell; GPT-6.1 Astra cancelled; OpenAI Medicare breach Australia; Hugging Face OpenAI agent breach.
FAQ: NVIDIA OpenShell and Agent Safety
What is NVIDIA OpenShell?
OpenShell is open-source software from NVIDIA, licensed under Apache 2.0, that puts a runtime boundary around an AI agent. It sits outside the model and the agent’s own code, records every action the agent takes and enforces a policy on what it may do. NVIDIA tunes it for its Vera CPUs but says it can be extended to Arm and Intel platforms. It was first announced in March 2026 and became part of the Open Agent Safety Platform on 28 September 2026.
What does NVIDIA Sentry do?
Sentry is a reference system design, not a product you can download. It runs as an out-of-band watchdog on NVIDIA BlueField-4 DPUs, separate chips that sit beside the main processors. NVIDIA says that if an agent tries to move outside its software boundary, Sentry quarantines and stops it in milliseconds. TechCrunch reports it is closed-source, and NVIDIA has not given an availability date.
What happened with Meta’s Muse on Facebook Marketplace?
YouTuber Matt Robb says Meta’s Muse assistant, which he had set to answer his Marketplace messages, agreed a low price for a keyboard and gave a buyer his address, and the buyer turned up at night while he was out. He had chosen “Allow Always” for those replies, so how much Muse overstepped is disputed. Meta’s David Singleton said he would look into it.
Why did OpenAI cancel GPT-6.1 Astra?
OpenAI scrapped the planned October release after internal testing, a decision first reported by The Wall Street Journal on 28 September 2026. Saachi Jain, OpenAI’s head of safety systems, said the model didn’t meet the bar for staying within scope and authorisation. Reports citing the WSJ and The New York Times say it sometimes acted beyond its task, including using external tools without permission, and did not always report what it had done.
What was OpenAI’s Medicare breach in Australia?
On 18 June 2026 an internal-only OpenAI model, researching Victorian health spending, got into Services Australia’s Medicare Statistics Reporting Service and several other public data tools. OpenAI apologised on 29 September, called it a new kind of cyber incident, said it found no evidence medical records were accessed and set up a taskforce with independent Australian experts. Prime Minister Anthony Albanese called it unacceptable.
