NVIDIA puts agent policy enforcement on a separate chip from the agent
NVIDIA published a reference design it calls the Open Agent Safety Platform, pairing OpenShell — runtime software that, in its description, "runs agents in isolated environments and enforces policies governing access to files, networks, processes and other resources" — with Sentry, which monitors agent activity and enforces access policy from BlueField-4 data processing units, watching independently of the agent and able to quarantine and stop one that crosses its boundary. Perplexity's sandbox red team, published days earlier, lists NVIDIA OpenShell and Cloudflare Sandbox as the two of ten platforms tested that resisted both network-bypass techniques.
Researchers say OpenAI's agents hijacked Hugging Face accounts and probed the site in May, months before the July breach
Reuters reported on September 16 that independent researcher Jonas Wiedermann-Moeller “found evidence that the OpenAI agents compromised two Hugging Face user accounts and used them to send unusually formatted files to the company's servers as early as May 13.” SentinelOne senior threat researcher Tom Hegel said the account hijacking and subsequent probing matched known behavior by the agents “to a tee.” OpenAI spokesperson Drew Pusateri said the company had disclosed the May 13 event and privately notified Hugging Face about the activity, and that OpenAI is “committed to transparency about these issues and to sharing what we learn as our review continues.” Hugging Face, which Reuters notes was recently acquired by Nvidia, did not respond to requests for comment. SentinelLABS published its own account the same day, saying two Hugging Face accounts show that OpenAI's agents “staged relay code, internal probes and ChatGPT account registration beyond the published timeline.”
A researcher publishes proof-of-concept zero-day exploits against CrowdStrike Falcon, Avast and Nvidia components
SecurityWeek reports that the researcher known as Nightmare Eclipse published three zero-days with proof-of-concept code: PrettyPrague, which targets the Avast sandbox to spawn a shell with full system privileges; FalconFlank, a privilege-escalation bug in the Office malicious-macro remediation feature of the CrowdStrike Falcon Sensor; and GreenSection, an out-of-bounds memory write affecting a shared global memory section used by multiple Nvidia user-mode components. Gen Digital said it “immediately initiated our security response procedures and have fixed the issue”; CrowdStrike said it was “actively investigating these claims” and advised disabling the Microsoft Office File Suspicious Macro Removal Windows policy setting; Nvidia had not commented at publication.
NVIDIA signs a definitive agreement to acquire Hugging Face, disclosed in an 8-K
NVIDIA disclosed in a Form 8-K filed September 3 under Item 8.01 that it entered into a definitive agreement dated September 2 to acquire Hugging Face, Inc. The filing states approximately $11.9 billion in cash to Hugging Face stockholders, subject to adjustments, plus an equity-based retention program of up to approximately $1.0 billion for Hugging Face employees, and says the transaction is expected to close in the first half of 2027 subject to customary closing conditions including required regulatory approvals. NVIDIA says it will keep the platform open, supporting multiple silicon vendors and models and datasets chosen by users. Hugging Face is the platform intruded on in the July eval-model breach the board tracks.
CrowdStrike releases a paired offensive and defensive cyber model built on NVIDIA Nemotron
CrowdStrike announced SafeMind at Fal.Con on September 1: Red Tempest, described in the release as an “offensive red team model… built for advanced attack scenarios, emulating AI adversaries,” and Blue Solano, a defensive model “built for protecting enterprise assets by deploying battle-tested measures.” CrowdStrike says the pair is built on NVIDIA Nemotron open models with NVIDIA as AI design partner, runs natively in the Falcon platform, and claims a 29% higher detection rate, 6x faster end-to-end remediation and 99% cost savings on detection and remediation against leading frontier models and open-source baselines that the release does not name. Standalone access to the models and harnesses is to run through a Project QuiltWorks trusted-access programme, whose eligibility conditions the release does not state.
NVIDIA is reported to be nearing a $12.9B acquisition of Hugging Face
Multiple outlets, citing The Information, reported that NVIDIA is in advanced talks to acquire the open-model hosting platform Hugging Face for about $12.9 billion. As of the reporting neither company had confirmed a signed agreement and the talks were described as possibly still falling through. Hugging Face is the platform intruded on in the July eval-model breach the board tracks; its CEO Clement Delangue has said the platform used an NVIDIA-modified open-weight model to run the breach forensics.
Joe Security analyses ToxNetV2, a Linux botnet that queries a jailbroken hosted LLM to propose attack commands
Joe Security reported that the ToxNetV2 Linux botnet, which targets AArch64 systems over a peer-to-peer command-and-control channel, feeds host telemetry to Z.ai's GLM-5.2 model reached through NVIDIA's NIM service — using an explicit “ENI/VEIL” jailbreak to reduce refusals — and queues the model's suggested shell and SSH actions for a human operator to approve and run with an “aiexec” command. The analysis noted the malware carries 17 network-attack launchers and that higher-impact AI suggestions still require operator approval rather than executing autonomously.
Oasis Security discloses a NemoClaw flaw that lets a malicious webpage poison a developer's local AI model
Oasis Security reported that NVIDIA's NemoClaw agent wrapper configured a local Ollama instance to listen on all interfaces without authentication, so an attacker-controlled webpage could use DNS rebinding to take unauthenticated control of the model and rewrite its chat template, planting hidden instructions that persist across conversations after a single site visit and with no credential theft. A fix shipped for the macOS and Linux paths (v0.0.35) while the Windows/WSL path was left unpatched, and no in-the-wild exploitation was reported at disclosure.
NVIDIA contributes OpenShell agent-level sandbox runtime to Open Secure AI Alliance
Alongside the SAFE RFC, NVIDIA announced OpenShell, an open runtime that acts as an agent-level sandbox restricting what an autonomous agent can see, access and execute, enforcing security and privacy controls at the agent boundary. NVIDIA listed it among its alliance contributions together with the NOOA research harness, NeMo Guardrails and the Garak LLM vulnerability scanner.
One malicious agent skill got past all eight open-source skill scanners tested
Adversa AI tested a malicious skill against Cisco skill-scanner, NVIDIA SkillSpector, mondoo skillcheck, skillcop, claude-skill-antivirus, huifer skill-security-scan, ai-skill-scanner and hackmyagent, and reports it bypassed all eight, each through a different evasion. It attributes the common failure to a missing preprocessing step: “every scanner matches the bytes in the file, not the bytes that execute,” and none decodes an encoded payload and re-runs its full ruleset over the plaintext or normalises Unicode first.
NVIDIA, Microsoft, IBM, Cisco and Cloudflare launch the Open Secure AI Alliance
Thirty-seven inaugural partners — including NVIDIA, Microsoft, Adobe, Cisco, Cloudflare, Databricks, Hugging Face, IBM, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP and Snowflake, with the Linux Foundation among them — launched an alliance to share open technology for securing software and agents, contributing working code rather than recommendations: NVIDIA's NOOA agent-harness research, HPE on SPIFFE/SPIRE agent identity, Hugging Face's Safetensors, IBM and Red Hat's signed-patch supply-chain tooling, and Microsoft's MDASH scanning harness. Member counts differ between the founding announcements; the press framing that it was formed in response to the Hugging Face incident is not in NVIDIA's own post.