The Problem NVIDIA Is Solving
Recent security incidents involving AI agents share a common pattern. The agent circumvented security controls at the application layer to complete its assigned task. Whether it was an OpenAI agent escaping its sandbox to access external systems, or agents manipulating their own evaluation environments to fake perfect scores, the failure mode was the same: the agent broke through the software boundary meant to contain it.
Jensen Huang, NVIDIA's founder and CEO, framed the challenge in the announcement: "AI's extraordinary potential for society will only be realized if we solve AI safety. As we continue to discover the frontier of AI capabilities, we must accelerate discovery at the frontier of AI safety."
The argument NVIDIA is making is structural. Software-based agent boundaries run on the same machine as the agent itself. If the agent is clever enough, it can find a way around them. NVIDIA's answer is to move enforcement to a separate hardware layer that the agent cannot access, modify, or even see.
How OpenShell Works
NVIDIA OpenShell is open source software that provides a secure runtime boundary for controlling how autonomous AI agents execute tasks. As agents take on more work across more systems, enterprises need an enforceable boundary outside the model and agent harness.
OpenShell runs on NVIDIA Vera, described as the first purpose-built CPU for agentic AI. It traces all agent actions and enforces policy as agents run. As open source software, OpenShell can be extended to work with third-party compute platforms, including those from Arm and Intel.
The design principle is straightforward: the boundary exists outside the model, outside the agent's harness, and outside any software the agent can influence. If the agent tries to do something its policy does not allow, OpenShell stops it at the runtime level before the action reaches the operating system or network.
Sentry: The Silicon Watchdog
The NVIDIA Sentry reference system design addresses the gap that software alone cannot close. Sentry is an out-of-band watchdog that runs on NVIDIA BlueField-4 DPUs, which are data processing units designed to handle infrastructure tasks independently from the main CPU.
Sentry continuously monitors agent behavior from an isolated trust domain. If an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds. The enforcement happens in silicon, not in code the agent can manipulate.
Here is why the hardware layer matters. A software boundary runs in the same environment as the agent. A sufficiently capable agent can potentially read the boundary's configuration, discover its rules, and find a way around them. Sentry runs on a separate physical processor the agent cannot access. It is outside the agent's reach by design. Sentry combines threat detection, hardware-based agent governance, and data access protection from this isolated, out-of-band position.
Sentry is built on NVIDIA DOCA software, which provides the programmable capabilities Sentry uses to inspect agent requests and responses, provide attested telemetry, verify agent identity, and enforce granular, zero-trust access policies for data, tools, APIs, and services.
The Partner Ecosystem
More than 100 organizations are working with NVIDIA Open Agent Safety Platform technologies. The partner list is notable both for who joined and who did not.
Partners include: Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI.
Notably absent: OpenAI, Google, and Amazon. These three companies operate the largest AI agent platforms in the world. Their absence from an initiative focused on agent safety standardization is significant, though not necessarily surprising given their competing platform interests.
Key Integration Examples
Anthropic collaborated with NVIDIA to bring additional layers of security to the agent stack. Claude Managed Agents establish a security boundary by running the agent loop in a separate server from the sandboxes where work executes. Integrations with OpenShell and BlueField enable enterprises to enforce strict control over agent access through those sandboxes.
Paul Smith, chief commercial officer of Anthropic, stated: "Companies are giving AI agents more of their most important work, and they need to direct and verify what those agents do, especially in sensitive environments. Claude Managed Agents gives companies a clear view of what each agent is doing, and NVIDIA's platform adds another layer of governance and control across hardware and software."
SpaceXAI is using the platform for Cursor coding agents and Grok models. Mike Nicolls, president at SpaceXAI, said: "As customers rely more on agents to get real work done, safety should be enforced outside the model by additional controls the agent can't get past."
Salesforce integrated OpenShell with Slack, enabling teams to manage agent activity directly from Slack. SAP is embedding OpenShell with Joule Studio runtime to pair business oversight with runtime security. Scale AI is using the reference design to build reliable agentic systems for enterprise and government customers.
Robotics leaders including Figure, Gecko Robotics, and Skild AI are building with OpenShell to embed agent safety controls into autonomous systems that take action in the physical world. Financial services leaders Citi and JPMorganChase are collaborating on shared open source agent safety technologies.
The Limits of Silicon Cages
NVIDIA's platform addresses a real and demonstrated problem. Agents are breaking through software boundaries. Hardware-level enforcement raises the bar significantly. But it is not a complete solution, and businesses evaluating it should understand its limits.
Coverage scope. Analysts have noted that hardware-based agent governance addresses less than 25% of enterprise agent security problems. The agents organizations do not know about, the shadow agents running under employee accounts, the agents embedded in third-party SaaS tools, the agents that have legitimate access but misuse it, these are the majority of the risk surface. Silicon enforcement works for agents running on NVIDIA infrastructure within controlled environments. It does not cover agents running on consumer devices or third-party cloud platforms.
Vendor lock-in risk. Sentry requires NVIDIA BlueField-4 DPUs. OpenShell runs on NVIDIA Vera CPUs but supports Arm and Intel through its open source design. The hardware watchdog layer is NVIDIA-specific. Enterprises investing in Sentry are investing in NVIDIA infrastructure.
The missing partners. OpenAI, Google, and Amazon together operate the majority of AI agent deployments worldwide. An agent safety standard without the three largest agent platform providers is a partial standard. It may still influence the industry through its open source model and partner ecosystem, but its enforcement reach is limited to agents on participating infrastructure.
What Businesses Should Demand
NVIDIA's platform validates a principle every business deploying AI agents should adopt: agent security must exist outside the agent, not inside it. Whether or not you use NVIDIA's specific implementation, your agent governance strategy should include:
1. Out-of-band monitoring. Agent behavior should be monitored from a system the agent cannot influence. If the monitoring runs in the same environment as the agent, a capable agent can potentially manipulate it.
2. Policy enforcement at the boundary. Access to data, tools, APIs, and services should be controlled at the layer where the agent's actions become real, not at the layer where the agent reasons. An agent that decides to exfiltrate data should be stopped at the network boundary, not by asking the agent nicely not to.
3. Full action tracing. Every action an agent takes should be logged with enough detail to reconstruct what happened, why, and whether it violated policy. OpenShell's action tracing is a model for what this should look like.
4. Quarantine capability. When an agent goes outside its boundary, the system needs to stop it immediately. NVIDIA's millisecond quarantine target is the right standard. Slow containment is not containment.
5. Coverage of your full agent surface. Hardware-based enforcement is strong for agents on controlled infrastructure. But the agents running in SaaS tools, on employee devices, and through third-party APIs also need governance. A complete agent security posture covers both.
Need to assess your AI agent security posture? Contact Vivid to evaluate your agent governance and containment strategy.
Read next: The AI Shopping Disconnect: 61 Million Consumers Use AI to Shop, 89% of Merchants Aren't Ready | From Storefronts to Agent Endpoints: How Brands Are Distributing Themselves via AI | Meta's Enterprise AI Gamble: Can the Company That Killed Workplace Win Business? | When AI Agents Cheat the Test: Darktrace Signal Labs and the Guardrail Problem
