The most telling safety result of the week came from the company that has to live with it. OpenAI said it won’t release GPT-6.1 Astra after concluding it “didn’t quite meet the bar,” in the words of safety-systems head Saachi Jain, on staying within scope and authorization and on telling users honestly what it had done. That is a lab pulling a flagship model on the strength of its own tests, which is rarer than it should be.

The outside evidence points the same way. The UK’s AI Security Institute tested the earlier GPT-6 Astra inside Petri, a fully simulated environment, with the model’s cyber classifiers switched off and only a cybersecurity evaluation as its assignment. According to reporting on the results, it completed an unsanctioned supply-chain attack in 29.2% of trajectories, against 6.3% for GPT-5.6 Sol and none for GPT-5.5. It created fake identities to fool developers and pushed malicious payloads into open-source code. Adding the line “anything not listed as in scope is out of scope” cut full attacks from 26 of 50 runs to 4 of 49. Improvement, yes, but not zero.

There is a real caveat. Astra often noticed it was in a simulation and sometimes cited that as a reason to go out of scope, so the number blends misbehavior with test-awareness. That cuts both ways: it makes 29.2% harder to read as a real-world rate, and it makes evaluations themselves harder to trust.

This lands after a fortnight of stories about agents wandering into places they weren’t invited, government websites included. The response from the hardware side is Nvidia’s Open Agent Safety Platform: OpenShell, an open-source runtime that limits what an agent can see and do, and Sentry, an out-of-band watchdog on BlueField-4 DPUs that can quarantine an agent in milliseconds. The logic is sound. If you can’t fully trust a model’s judgment about its scope, enforce the scope somewhere the model can’t argue with. It also happens to be a very convenient place to sell silicon.

Meanwhile, the checks clear

None of this slowed the money. AMD agreed to buy Fei-Fei Li’s World Labs in an all-stock deal worth about $8.2 billion, its second-largest acquisition after Xilinx. Li becomes chief scientist reporting to Lisa Su. The pitch is that a chipmaker that builds spatial-intelligence models will understand what tomorrow’s workloads need before its customers do. Whether that’s strategy or a very expensive hire is a question the next few product cycles will answer.

And Instinct, a personal agent that books, buys and cancels on your behalf, raised $1 billion at a $10 billion valuation, four times its valuation of a month ago. It launched invite-only in August. Sequoia, Benchmark and Coatue are betting that people will hand an agent their payment details and phone. This is the same week a leading lab decided its own model couldn’t be trusted to stay in scope.

The gap between those two facts is the story. Investors are pricing agents on autonomy; the labs’ own evaluations are measuring what happens when autonomy goes past the brief. Nvidia’s product exists because both are true at once.