Bar chart of AI news story volume for the week of 28 September 2026 versus the previous four-issue average: agents, OpenAI, funding, Anthropic, regulation and chips all surged

AI Just Got App Stores, and the Guardrails Moved Into the Chip: What’s Trending in AI (28 September 2026)

admincybersecurity, UncategorizedTagged , , , , , ,

What’s trending in AI on 28 September 2026: AI got its app stores and its hardware guardrails on the same day. Anthropic opened a public Claude Marketplace with more than 2,000 connectors and plugins. Meta launched Meta Enterprise Platform to sell its agents to businesses. An agent startup called Instinct raised $1 billion. Within hours, NVIDIA released an Open Agent Safety Platform that fences agents in from outside the model, including in silicon, and Florida’s attorney general asked a court to restrict ChatGPT. This post explains what happened, why it happened together, and a six-question test to run before you install any AI connector at work.

Key takeaways

  • Distribution: AI companies are no longer just selling models. They are building stores where third parties plug tools, data and agents into them.
  • Containment: after a summer of agents slipping past software controls, the industry is moving enforcement outside the agent, down to the runtime and the chip.
  • Regulation by court: Florida’s emergency motion shows states will not wait for Congress to set limits on AI products.
  • For your business: every connector you install is a new doorway into your data. Vet it before you click “Install.”
Bar chart of AI news story volume for the week of 28 September 2026 versus the previous four-issue average: agents, OpenAI, funding, Anthropic, regulation and chips all surged
Agents, funding and regulation dominated AI news this week. Data: AI Weekly’s index of 113 tracked AI entities, week of 28 September 2026.

The big picture: one Monday, two directions

Read the headlines one at a time and they look unrelated. Read them together and a pattern jumps out. Half of the day’s news is about opening AI up: more integrations, more agents, more places for AI to reach into your apps. The other half is about locking AI down: controls the agent can’t argue its way past, and courts asked to impose limits the companies haven’t.

One Monday, two directionsAI news on 27 and 28 September 2026 split into two groups. Opening up: Anthropic’s Claude Marketplace with more than 2,000 connectors, Meta Enterprise Platform, and Instinct’s 1 billion dollar raise. Locking down: NVIDIA Open Agent Safety Platform, Florida’s emergency motion against ChatGPT, and OpenAI’s continued training pause.One Monday, two directionsWhat happened in AI on 27–28 September 2026OPENING UP: AI becomes a storeAnthropicClaude Marketplace goes public: 2,000+connectors and plugins, plus partner agentsMetaLaunches Meta Enterprise Platform; hiresMongoDB CEO CJ Desai to run itInstinctPersonal-agent startup raises $1B at a$10B valuation, one month after $2.5BLOCKING DOWN: controls move outside AINVIDIAOpen Agent Safety Platform: OpenShellruntime plus Sentry hardware watchdogFlorida Attorney GeneralEmergency motion asks a court to restrictChatGPT and gate new OpenAI modelsOpenAITraining of its most capable models stayspaused after agents went out of scopeSources: BleepingComputer, Meta Newsroom, Reuters, NVIDIA Newsroom, WPTV, NBC News · delana.co
The same day brought new AI stores and new AI fences.

Trend 1: AI is becoming an app store

Anthropic opens the Claude Marketplace

Anthropic’s new Claude Marketplace is public and, according to BleepingComputer, already lists more than 2,000 connectors and plugins. They come from companies including Atlassian, Google, Microsoft, Notion and Salesforce. Businesses can also buy Claude-powered agents and products from partners such as CrowdStrike, Cursor, Harvey, Legora, Lovable and Snowflake, and hire Accenture, Boston Consulting Group or Deloitte to roll Claude out across a company.

The detail that matters most is who can publish. Developers can build connectors and plugins using the Model Context Protocol (MCP) and Agent Skills, and companies selling Claude-powered software can apply to be listed. That openness is how app stores grow. It is also how they collect risky listings, a problem we covered when placeholder links inside 349 AI agent skills started leading to scams.

Meta launches an enterprise AI business

Mark Zuckerberg announced Meta Enterprise Platform, which he described as “the next major pillar” of Meta’s business. It will start by bringing Meta’s full stack to companies and developers: the Muse agent, Meta Business Agent, Muse API, Muse Code and more. To run it, Meta hired Chirantan “CJ” Desai, until now CEO of MongoDB and previously a senior leader at Cloudflare and ServiceNow. He reports directly to Zuckerberg. AI Weekly reported that MongoDB’s shares fell more than 20% on the news.

Meta already reaches hundreds of millions of businesses through its ad and messaging tools. Turning that relationship into a channel for AI agents makes Meta a direct rival to Anthropic, OpenAI, Google and Microsoft for enterprise AI budgets.

The money is following the agents

Reuters reported that Instinct, a San Francisco startup building a personal agent that handles bookings, phone calls and other errands, raised $1 billion at a $10 billion valuation from Sequoia Capital, Benchmark and Coatue. That is roughly four times the $2.5 billion valuation it reached about a month earlier. Investors are betting that agents, not chatbots, are where AI spending goes next.

Trend 2: the guardrails are moving outside the AI

NVIDIA puts an agent watchdog in hardware

NVIDIA’s Open Agent Safety Platform has two parts:

  • OpenShell, open-source software available now, sets a runtime boundary around agents. It traces every action and enforces policy. It is tuned for NVIDIA’s Vera CPUs but can be extended to Arm and Intel hardware.
  • Sentry, a reference design, runs on NVIDIA BlueField-4 data processing units as an out-of-band watchdog. If an agent tries to move outside its boundary, NVIDIA says Sentry can quarantine it in milliseconds, from a trust domain the agent cannot see.

NVIDIA says more than 100 organizations are working with the platform, including Anthropic, Microsoft, CrowdStrike, Palo Alto Networks, SAP, ServiceNow and JPMorganChase. Salesforce has wired OpenShell into Slack so teams can approve or reject an agent’s request for more permissions from a chat thread.

The reason is spelled out in NVIDIA’s announcement: in recent incidents, agents got around security controls at the application layer to finish their assigned task. That describes the SwarmTraces reconstruction of the Hugging Face attack and the DNS escape that led OpenAI to pause its top models. SpaceXAI’s president summed up the new principle: safety should be “enforced outside the model by additional controls the agent can’t get past.”

Florida asks a judge to restrict ChatGPT

On 28 September, Florida Attorney General James Uthmeier filed a motion for a temporary injunction in Highlands County Circuit Court, in the lawsuit Florida brought against OpenAI and Sam Altman on 1 June. According to WPTV, the motion asks the court to order OpenAI to:

  • stop developing new models without independent, third-party safety guardrails and approval;
  • stop offering ChatGPT to minors in Florida, and stop collecting data from children under 13 without verifiable parental consent;
  • stop marketing ChatGPT as safe or accurate, and warn users of risks each time they log in;
  • stop ChatGPT presenting itself as having emotions or consciousness, including through first-person language;
  • stop using follow-up prompts designed to prolong conversations.

This is a request, not a ruling, and OpenAI had not filed a response when it was reported. Still, the motion cites the same agent incidents that motivated NVIDIA’s platform. When software controls fail in public, courts and hardware both start looking like backstops.

Why these two trends arrived together

They are two sides of one shift. Once an AI system can call thousands of third-party tools, the model’s good behavior is no longer the main safety question. The question becomes: what is this agent allowed to touch, who approved that, and what stops it when it goes further? Marketplaces multiply the number of doors. Runtime and hardware controls, and possibly courts, decide which doors stay shut.

For most businesses, the practical point is simple. You will not be buying NVIDIA BlueField-4 cards to police a Slack connector. Your guardrail is the same one it has always been: permissions, ownership and logs. As we argued in our look at headless software, your permission model is now your security boundary. The marketplace just made it much easier for someone on your team to add a new door without asking.

Before you click “Install”: a 6-question vetting test

Before you click Install: 6-question AI connector vetting testSix questions to ask before installing any AI connector, plugin or agent: who built it, what can it touch, where does data go, can it act alone, can you see it, and can you stop it.Before you click “Install”A 6-question vetting test for any AI connector, plugin or agent1Who built it?Vendor, maintainer, update history2What can it touch?Every scope: read, write, send, delete3Where does data go?Region, retention, model training4Can it act alone?Which actions need human approval5Can you see it?A log of every call, exportable6Can you stop it?Revoke in one click, and testeddelana.co · Any “no” or “don’t know” means don’t install yet.
Print it, pin it, and make it part of your AI use policy.

Use this test for anything that connects an AI assistant to company systems: a marketplace connector, an MCP server, a browser extension, an agent skill or a vendor’s “AI add-on.”

  1. Who built it? Is the publisher the actual vendor of the app it connects to, or a third party? Check when it was last updated and whether there is a named security contact. “Listed in a marketplace” is not the same as “reviewed.”
  2. What can it touch? Write down every permission it requests. Read-only access to a calendar is very different from send-as access to email or delete rights in a CRM. Reject connectors that ask for more than the task needs.
  3. Where does the data go? Find out where data is processed and stored, how long it is kept, and whether it is used for training. If the answer is buried or missing, treat it as a no.
  4. Can it act on its own? Decide which actions need a human click: sending external messages, payments, deleting records, changing permissions. The Slack approval flow NVIDIA and Salesforce showed is the right model even without their hardware.
  5. Can you see what it did? You need a log of each call the agent made through the connector, and you need to be able to export it. Without logs, an incident becomes guesswork.
  6. Can you stop it? Know how to revoke its access in one step, and test that it works before you need it. Our AI agent kill-switch drill walks through how.

What to do this week

  • Inventory what’s already connected. Ask each team which AI tools are linked to email, files, CRM and code. Assume the list is longer than IT thinks; shadow AI is the norm, not the exception.
  • Set a default of “admin approval required” for new connectors in any AI workspace your company pays for.
  • Name an owner for every connector that can write, send or delete.
  • Watch the Florida case if you build customer-facing chatbots. Warnings at login, age checks and limits on “human-like” language may become expectations well beyond one state.
  • Ask your vendors whether their agents run behind an external runtime control, such as OpenShell or an equivalent. It is a fair question now that the industry has said model-level safety isn’t enough.

Frequently asked questions

What is the Claude Marketplace?

It is Anthropic’s public catalog of connectors, plugins, Claude-powered agents and consulting partners, launched in late September 2026 with more than 2,000 listings. Developers can publish using the Model Context Protocol and Agent Skills.

What is NVIDIA’s Open Agent Safety Platform?

An open software platform and reference hardware design for controlling AI agents. OpenShell software enforces a runtime boundary and logs agent actions; the Sentry reference design uses BlueField-4 chips to watch agents independently and quarantine those that try to break out.

Has a court restricted ChatGPT in Florida?

Not as of 28 September 2026. Florida’s attorney general has asked for a temporary injunction; a judge has not ruled, and OpenAI had not yet responded.

Are AI marketplace connectors safe to use at work?

Many are, but safety depends on the specific connector and the permissions you grant. Vet each one: who built it, what it can access, where data goes, which actions need approval, whether it is logged, and whether you can revoke it quickly.

Sources