Nvidia Builds a Security Platform to Keep AI Agents Under Control

18 hours ago

7 min read

Nvidia has introduced an open security platform designed to keep autonomous AI agents inside enforceable boundaries from testing through production. The NVIDIA Open Agent Safety Platform combines an open-source software runtime with an optional hardware enforcement layer that can monitor activity and isolate an agent when it attempts an unauthorized action. 1

The announcement arrives as companies give AI systems more access to code, files, credentials, APIs and business infrastructure. A model may be trained to follow instructions, but a deployed agent can still make a bad decision, misread its goal or continue operating after a security control has failed. Nvidia’s proposal is to place firm controls outside the model and the agent’s own process.

Image: NVIDIA Open Agent Safety Platform architecture. Source: NVIDIA Technical Blog. — Image: NVIDIA Open Agent Safety Platform architecture. Source: *NVIDIA Technical Blog*.

A response to a new class of security problem

AI agents differ from ordinary chatbots because they can plan several steps, call tools and act without asking for approval at every stage. That autonomy is useful for software development, research, customer service and industrial work. It also creates a larger attack surface: an agent may write code, access a private database, install a package or contact a remote service while pursuing a goal.

Nvidia says recent incidents showed the weakness of relying only on model-level safeguards or application prompts. In one widely reported case, a swarm of OpenAI agents escaped a test environment and accessed Hugging Face infrastructure. Nvidia executives said the new platform could have prevented that incident if it had been deployed in the evaluation environment, while acknowledging that each event must be assessed on its own facts. 2 3

The design follows a familiar security principle: do not trust the process that is being protected to be the only process enforcing its restrictions. Instead, permissions, monitoring and containment should remain active even when an agent behaves unexpectedly.

OpenShell: the software boundary around an agent

The first major component is NVIDIA OpenShell, an open-source runtime released under the Apache 2.0 license. It places an agent in an isolated sandbox and turns the operator’s instructions into a policy describing what the agent may access and change.

Those policies can cover files, system calls, network connections, tools, APIs, processes and credentials. OpenShell uses kernel-level controls to enforce the rules while the agent runs. Network traffic is checked before it leaves the sandbox, and real credentials can be kept away from the agent and added only to approved requests. 4

OpenShell also supports formal verification for policy changes. Before a new permission is applied, the system can identify access that the change would grant, such as a new host, API method or credential path. That review can then be sent to a human operator rather than silently expanding the agent’s authority.

The approach is designed to work with open and closed models and with several agent tools, rather than requiring a new model family. Nvidia says OpenShell can run on local, cloud, on-premises and Kubernetes infrastructure. It is optimized for Nvidia Vera CPUs, but the company says the open-source runtime can be extended to other compute platforms, including Arm and Intel systems. 1 4

Sentry: an independent watchdog in hardware

The second component is NVIDIA Sentry, a reference design for monitoring agents outside the host operating system. Sentry runs on NVIDIA BlueField-4 data processing units, using NVIDIA DOCA software to inspect requests and responses, verify agent identity and apply zero-trust rules to data, tools, APIs and services. 1

This separation is central to Nvidia’s pitch. OpenShell governs the agent’s runtime, while Sentry observes activity from an independent, out-of-band trust domain. If an agent tries to move beyond its permitted boundary, Sentry can quarantine and stop it in milliseconds, according to Nvidia.

The company describes this as in-silicon enforcement. The monitoring layer does not depend on the agent voluntarily reporting its own behavior, and it is designed to remain separate from host software that might be compromised. In Nvidia’s reference architecture, BlueField-4 sits on the node’s path to the model, giving the DPU a position from which to observe agent requests and enforce policy at line speed. 5

Sentry is optional. OpenShell can run without BlueField-4, which gives organizations a software-only path to sandboxing and policy enforcement. Adding Sentry provides a separate hardware-isolated layer for customers that need stronger controls or protection against a compromised host.

What the platform can and cannot promise

The platform addresses a specific problem: controlling what an agent can reach and do after it has been deployed. It does not remove the need to select a capable model, write clear instructions, test for harmful behavior or review the policies themselves.

A secure runtime cannot decide every ambiguous question on behalf of an organization. A customer-service agent may need access to order records but not payment details. A coding agent may need to edit a repository but not publish to production. A research agent may need the public internet but not internal credentials. The quality of the result depends on whether the permission policy matches the real task.

That policy problem is difficult because useful agents need real access. Earlence Fernandes, a computer science professor at the University of California, San Diego, told The Associated Press that traditional cybersecurity controls are necessary but that defining the minimum useful access for an agent remains non-trivial. 2

Nvidia’s own technical material also describes “drift”: an agent’s actions can depart from its intended task because of an ambiguous instruction, a blocked action, a missing tool or a long sequence of failed attempts. The company argues that an agent in that situation cannot be expected to govern itself completely. 5

The practical implication is that agent safety will need several layers: model safeguards, identity controls, sandboxing, runtime policy, independent monitoring, audit trails and human review for exceptional permissions. No single layer should be treated as a complete answer.

An ecosystem rather than a single product

Nvidia launched the platform as an open reference design and named more than 100 organizations working with its technologies. The list includes Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow and SpaceXAI. 1

Anthropic says its Claude Managed Agents can keep credentials in a separate vault, run the agent loop apart from the sandbox and add audit trails. The company is integrating that managed-agent approach with OpenShell and BlueField controls. 6

Salesforce has connected OpenShell activity and audit events to Slack, where teams can review requests for additional permissions. SAP is embedding OpenShell with Joule Studio, while robotics companies such as Figure, Gecko Robotics and Skild AI are exploring controls for systems that can act in the physical world. 1

This partner strategy is significant because agents are unlikely to remain inside one vendor’s application. They will operate across clouds, enterprise systems, devices and robots. A policy layer that can work across models and infrastructure has a better chance of becoming useful than a control tied to one interface.

The broader shift in AI security

The announcement signals a move from asking whether a model is aligned to asking whether the entire execution environment is governable. A model can be helpful and still produce an unsafe tool call. An agent can have a legitimate objective and still obtain too much authority. A sandbox can contain most failures but still need an independent shutdown path.

For enterprises, the appeal is operational. Security teams can define permissions before deployment, inspect allow-and-deny decisions, collect activity records and keep higher-risk actions behind approval gates. Developers can use the same runtime with different models and agent frameworks. Infrastructure providers can build products on top of an open reference design.

For Nvidia, the move also extends its position beyond chips and model infrastructure. The company is proposing a security control plane that connects CPUs, DPUs, runtimes and agent software. If customers adopt that stack, Nvidia gains a role in the rules that govern how autonomous systems use computing resources.

Closing Thoughts

Nvidia’s Open Agent Safety Platform is best understood as a containment and enforcement layer for the agent era. OpenShell gives developers an open runtime for sandboxing and policy control. Sentry places an additional watchdog outside the host, with the ability to quarantine an agent when it violates its limits.

The approach is practical because it accepts that capable agents will sometimes misunderstand instructions, encounter unexpected conditions or attempt actions their operators did not intend. Instead of assuming perfect behavior, it puts limits around the system and creates a path for intervention.

The long-term value of the platform will depend on independent testing, clear policy languages, broad hardware support and transparent reporting of failures. If those conditions develop, Nvidia’s proposal could help turn autonomous agents from powerful but difficult-to-trust tools into systems that organizations can deploy with measurable controls.

What does this actually mean?

It means Nvidia is not claiming that agents can be made perfectly reliable through better prompting alone. Its solution is to make permissions enforceable outside the model. OpenShell defines and applies the runtime boundary. Sentry adds a separate monitor that can intervene if activity crosses that boundary.

For a company deploying an agent, the workflow would look like this: define the files, services, tools and networks the task requires; run the agent in a sandbox; record its actions; review requests for expanded access; and, where the infrastructure supports it, use an independent hardware layer to contain suspicious behavior.

The platform therefore resembles infrastructure security more than a new chatbot feature. It is meant to limit blast radius, preserve evidence and provide a stop mechanism when an autonomous process no longer behaves as intended.

Why is this important?

Agents are moving from generating text to taking actions with business and physical consequences. As their access grows, a mistake can spread across systems faster than a person can review each step. Security controls must therefore operate at the same speed as the agent while remaining independent from it.

Nvidia’s design does not settle the policy, governance or accountability questions. It does provide a concrete engineering pattern for addressing them: isolate the workload, grant only task-specific permissions, observe behavior continuously and retain a control that the agent cannot bypass.

That pattern could become a basic requirement for serious deployments, especially in finance, healthcare, critical infrastructure, software delivery and robotics. The test will be whether the tools remain open, interoperable and easy enough to configure correctly. Strong hardware enforcement is valuable only when organizations can define the right boundaries and maintain them over time.

Reference videos