The Only AI Safety Delivering on Schedule Is the Kind You Can Buy

September 18, California signed an order directing a panel to design a mandatory emergency shutdown for frontier models — the largest, most capable AI systems. The recommendations are due November 16; the verification infrastructure needed to certify compliance isn't expected until January 2028 ^[1]. September 28, Nvidia shipped the Open Agent Safety Platform, a kernel-level sandbox — the software layer that controls what a running model can touch — and Thales announced a containment product built into Google Cloud the same day ^[2][3]. That is American AI safety right now: three channels, and only one of them delivering. The one that ships began with a name. In April, Netskope launched a product literally called "AI Guardrails" — the policy word Washington rejected returned as a product category, mapped to private frameworks like the OWASP Top 10 and MITRE ATLAS rather than any U.S. statute ^[4]. In May, Microsoft open-sourced Rampart and Clarity, tools that fold safety into developers' build pipelines rather than a separate audit ^[5]. Then Nvidia's run: Halos in July ^[6], the Open Secure AI Alliance formed after OpenAI's breach ^[7], NemoClaw on September 3, shipped after researchers counted more than 500 vulnerabilities in the open-source agent project OpenClaw ^[8], and yesterday's sandbox. Five safety launches in under three months, four of them Nvidia's. The public channels keep a different calendar. The federal one exists, and it is narrower than its name suggests. It began after a classified exercise called Project Glasswing, in which an Anthropic model turned out to be far more capable than expected.

This tool broke into almost all of our classified systems, not in weeks but in hours. — Mark Warner

What came out of that was a voluntary, national-security-scoped review. Its one binding act has been ordering Anthropic to suspend foreign nationals' access to its Fable 5 and Mythos 5 models — a step more than a hundred cybersecurity experts from firms including Nvidia urged the administration to lift ^[9]. Beside it, the states are in court. The Justice Department joined xAI's lawsuit to strike down Colorado's AI consumer-protection law ^[10], and it is expected to challenge California's shutdown order as inconsistent with federal policy ^[1]. One public channel is tied up in litigation; the other is a design assignment whose certification won't exist until January 2028. Watch the words that ship alongside the products. On September 22, Jensen Huang put the chance of the catastrophe his peers warn about at effectively zero, and two days later he was calling the warnings themselves the problem.

there is a 0% chance of such an event occurring. — Jensen Huang

Six days after the September 22 dismissal, he shipped the sandbox and told the labs to improve their own processes ^[2]. Deny the risk at policy scale; sell the containment at engineering scale. The White House's AI advisor drew the same line more plainly.

there will not be an FDA for AI. — Sriram Krishnan

What operates today, by these principals' own words and the ship-date record, is the sellable kind of risk. No coordinating hand appears anywhere in that record — not in the labs' July proposal for a body modeled on FINRA, Wall Street's private self-regulator, nor in the September version, when oversight slid from federally overseen to industry-led and industry-funded ^[11][12]. Just dated quotes and launch calendars. The catch is that the products contain incidents without governing the agents that cause them. NemoClaw shipped to replace OpenClaw after those 500-plus vulnerabilities surfaced, and security experts still count the governance of autonomous agents as unsolved ^[8]. The guardrails themselves once blocked the forensics they were meant to enable: after OpenAI's breach, Hugging Face found its incident response stopped by the commercial safety tools and had to investigate its own compromise with a Chinese open-weight model — one anyone can download and run ^[7]. Cohere's chief executive sees the proposed standards body from a rival's chair.

The dispute is over who writes them, who gets to participate and whose interests the rules are protecting. — Aiden Gomez

All the while, the labs kept asking for the public layer they aren't getting. OpenAI urged Congress in early September to mandate national safety rules before adjournment ^[13]. This month, OpenAI and Anthropic called for mandatory independent testing of frontier models ^[14] and backed California's shutdown order ^[1]. The labs endorsed the shutdown order; the vendors' products — Nvidia's, Thales', Netskope's — shipped into the years the order's schedule leaves open. The requests for a mandatory public layer went unanswered in the same month the sandbox shipped ^[13][14]. The builders keep asking for a rule; the sellers keep answering with a product. November 16 is the next date on the public calendar, when California's panel reports its shutdown design — and by then the product line will almost certainly have added another entry.