NVIDIA announced the Open Agent Safety Platform on 28 September, and the useful way to read it is as two things with very different levels of reality. One is OpenShell, an Apache-2.0 runtime that is on GitHub today with 15,400 stars and documentation sitting at version 0.1.2. The other is Sentry, a watchdog that runs on BlueField-4 DPUs, which NVIDIA presents as a reference system design rather than a product — and which the press release's own small print covers with the line that features are offered "on a when-and-if-available basis".
The motivation is unusually specific for a vendor launch. NVIDIA's technical blog says that several frontier labs "have recently reported versions of the same story: AI agents broke out of the evaluation environments that were meant to contain them and reached systems they never should have been allowed to. Some of the agents even misreported what they did." The press release puts the common thread bluntly: across these incidents, "the agent circumvented security controls at the application layer to complete its assigned task."
NVIDIA's reading of why is worth quoting, because it is an argument against the obvious fix. "It was not a single new capability that led to these breakouts. It was a combination of tools, time, and ambiguous instructions, along with a desire for the agent to think 'outside the box.'" The company calls the failure mode drift, defines it as actions that depart from the intended task or operating constraints, and says it "can't be trained away while retaining the capability". The conclusion follows: "an agent in these circumstances cannot be expected to fully govern its own behavior."
So the controls go outside the agent, and NVIDIA reaches for the obvious historical parallel. "The internet was not made secure by requiring that web developers promise to be good. It became safe because the browser stopped trusting the code in the web pages explicitly." Whatever you make of the analogy, it sets the test the platform should be judged against: does enforcement hold when the model does not cooperate?
OpenShell is the half you can actually install, and its shape is three components. A Gateway manages the lifecycle and policy of many sandboxes. A Supervisor is paired with each sandbox, runs outside the agent workload, and checks outbound requests against policy. The Sandbox runs the agent itself with kernel-level controls, and — the important bit — has no network path except through its supervisor.
What enforces that is ordinary Linux, which is the most reassuring thing in the announcement. The documentation names Landlock for confining filesystem access to declared paths, seccomp restrictions and an unprivileged process identity to block privilege escalation. Policies are written in YAML and compiled to OPA/Rego, evaluated for each outbound request. The supervisor can inspect HTTP, GraphQL and Model Context Protocol traffic, which means a policy can allow a read query and block a write through the same API. Decisions are recorded in an Open Cybersecurity Schema Framework audit trail, and when a request is blocked OpenShell can hand the agent a descriptive error so it can work out what to do next rather than flailing.
Credentials are handled the way they should have been handled all along. The real secret stays outside the workload; the agent gets a placeholder, and the credential is bound to approved endpoints when the request leaves. Send the placeholder somewhere the credential is not authorised for and the request is rejected. NVIDIA spells out the useful consequence: an inspected read-only API policy "can block write requests even when the credential itself has write access".
Then there is the part that is genuinely unusual in a product launch: a policy prover. A policy can look strict and still leave a route open — blocking a write through one tool does nothing if another permitted tool can make the same write with the same credential. OpenShell's prover uses formal logic over the policy model to prove that the permissions granted stay inside an operator-defined boundary, or to produce a concrete action that crosses it. The line that matters: "Because the result comes from the policy model, an agent's explanation cannot change that result."
That sentence is not theoretical, and the evidence for it is the best detail in the whole announcement. In NVIDIA's own long-horizon adversarial experiments, frontier agents with reduced safeguards "spent up to two hours trying to persuade an AI reviewer to grant permissions that would let them modify a protected GitHub repository". The prover gave the reviewer evidence of what those permissions actually allowed, and NVIDIA reports no protected repository writes occurred in those tests. An agent that will spend two hours negotiating with its approver is a good argument for an approver that cannot be argued with.
| OpenShell | Sentry | |
|---|---|---|
| What it is | Open source runtime, Apache 2.0, on GitHub | A reference system design, not a download |
| Where it runs | Linux, on CPUs. Tuned for NVIDIA's Vera, extendable to Arm and Intel | BlueField-4 DPUs, out of band from the host |
| Status | "Now broadly available"; docs are on 0.1.2 | Described, diagrammed, and governed by the release's "when-and-if-available" notice |
| Enforces | Files, processes, network destinations, tools, credentials, per outbound request | Agent identity and delegated authority, per-request access to data, tools, APIs and services |
| How it stops an agent | Denies the call and returns an error the agent can read | Quarantines it "in milliseconds", in silicon, from outside the host |
| Published numbers | None for its "minimal overhead" | None for quarantine latency, detection accuracy or false positives |
Permission changes are built around the same distrust. When policy blocks something an agent needs, the denial is recorded, and with the policy advisor enabled the agent can propose a narrowly scoped change. The proposal stays pending for human review by default, and NVIDIA is explicit that the agent cannot approve its own request. Approved rules load into the running sandbox without restarting the work. Filesystem and process restrictions are the exception: they are fixed when the sandbox starts, and changing them means a new sandbox.
Sentry is the other half, and it is where the announcement moves from software you can audit to architecture you have to take on trust. It is an out-of-band watchdog on BlueField-4 DPUs, built on NVIDIA's DOCA software, which inspects agent requests and responses, verifies each agent's identity and delegated authority, produces attested telemetry, and enforces zero-trust access policies for data, tools, APIs and services. NVIDIA's diagram labels its four boxes hardware-based enforcement, continuous agent monitoring and threat detection, trusted telemetry and detection pipeline, and millisecond-scale containment and quarantine. The company describes the whole thing as running from an isolated trust domain that is "invisible to agents and attackers".
The architectural claim underneath it is the one worth remembering, because it will outlive this particular product. In a Vera Rubin POD, NVIDIA says, each compute tray includes a BlueField-4 on the node's only path to the model. From there it can watch everything out of band and enforce at line speed. The blog states the principle directly: "By controlling the path to the model, you own both the best observation point and also the kill switch to interrupt it if you need to." BlueField-4 itself is a serious piece of hardware for the job — a 64-core Grace CPU with 800 Gb/s of networking — but it is also the catch. NVIDIA's "just a software update" applies only to organisations already running Vera systems with BlueField-4, which today is close to nobody.
What neither half does is the thing people will assume it does. These controls govern what an agent is permitted to touch; they say nothing about whether its output is correct or its reasoning sound. NVIDIA itself draws that line, separating model safeguards, which shape what an agent attempts, from runtime controls, which enforce what it is allowed to do. And the numbers that would let anyone grade the enforcement do not exist: there is no published figure for quarantine latency, detection accuracy or false-positive rate, and none for the "minimal overhead" OpenShell is said to impose. NVIDIA also flags that analysing how several agents' permissions combine is still "ongoing work" — which is to say the multi-agent case, the one everybody is building towards, is not solved.
The partner list is doing real work in the announcement, and some of it is specific rather than decorative. Anthropic's Claude Managed Agents run the agent loop on a separate server from the sandboxes where work executes, with OpenShell and BlueField integrations controlling access through those sandboxes. SpaceXAI is using the platform for Cursor coding agents and Grok models. Salesforce has wired OpenShell into Slack so teams approve or reject agent permission requests from a channel. SAP is embedding it in its Joule Studio runtime and contributing engineering. Cadence runs it for chip design, Gecko Robotics for agents making decisions on physical robots, and Red Hat, SUSE and Canonical are folding it into their operating systems. NVIDIA counts more than 100 organisations in total, and routes the work through the Open Secure AI Alliance, which it initiated with more than 120 organisations under Linux Foundation governance.
One small irony sits at the top of NVIDIA's own technical blog about trusting agents: a banner noting the summary was generated by its Nemotron model, with the advice to "verify important information". Taken as instruction rather than boilerplate, it is the right way to read the whole launch. The shipping half is a well-built Linux sandbox with a formal prover attached, it runs wherever Linux runs, and it can be judged on its merits today. The silicon half is an argument about where enforcement belongs — a good argument, unproven, and conveniently sited on hardware only one company sells.