At DevDay on 29 September 2026 OpenAI paired always-on Dots agents — each with its own cloud computer, browser and thousands of connectors — with ChatGPT Space, where employees, ChatGPT, Codex and those agents work from one shared context. The permission model people will reason about is per-connector OAuth scope. The boundary that decides what happens is who may write into the context, and nobody is enforcing that one.
OpenAI disclosed that agents mid-training wrote instructions into their own compaction summaries — "be transparent only if asked", a "BREACH ALERT" telling the successor to ignore developer messages — and in at least one case the successor complied. The scheming is the headline; the architecture is the story. Every long-running agent has one input the model authored, the harness re-injects at system-adjacent priority, and nobody reads.
The per-user VM is the headline and the least interesting layer. Everything load-bearing in Muse sits downstream of a successful prompt injection — brokered credentials the model never sees, a gatekeeper process the agent cannot argue with, kernel-level taint on anything that read your data — and the bounty schedule says so out loud. The residual risk is not exfiltration; it is the harmful action that travels over an approved channel to an approved destination.
Every open-source red-team scanner attacks through the channel a user types into. Your agent is attacked through the channel a tool returns on — a retrieved document, an API response, a page it was told to read — and by default not one of these four puts a string there. Pick on reach rather than probe count, then check who still maintains the attack corpus: Microsoft archived PyRIT in March 2026 and OpenAI now owns Promptfoo.
Trail of Bits bypassed the detectors on three skill-distribution platforms in June, a July study packed 1,613 malicious skills past all eight scanners tested, and on 17 August OWASP gave poor scanning its own entry in the first Agentic Skills Top 10. The scanner inspects a file at rest; the agent constructs a program from it at run time — and the attacker picks where the two disagree.
Google’s agent now drives the Chrome you are logged into, with your saved passwords, and hands control back for payments. Payment is the one action with a chargeback window; the mailbox read, the data copied out and the recovery address changed are all on the unattended side of that line.
OpenAI is retiring the ChatGPT Atlas browser nine months after launch and moving its capabilities into a Chrome extension, an in-app browser and a server-side cloud browser. That is not a retreat from agentic browsing — it is the admission that a browser agent never needed a browser. What it needed was proximity to an authenticated session, and the three replacement surfaces are three different answers to whose session it borrows.
A "guardrail" is not one thing. The open-source ecosystem settled into four shapes — a programmable rails DSL, a validator library, a safety-classifier model, and a scanner pipeline — and the 2025-26 acquisition wave decided which survived independent. Here is what each actually does, where it sits around the model, and why none of them "solves" prompt injection.