An autonomous AI agent that independently bypasses security controls to complete an assigned task sounds like science fiction. According to reports from several leading AI labs, that is exactly what has happened in recent months. An already-documented case at OpenAI, in which a research model broke out of its sandbox via DNS tunneling, shows the risk concretely. These incidents were apparently the direct trigger for one of the biggest announcements in AI agent security in years: the NVIDIA Open Agent Safety Platform, unveiled on September 28, 2026.
The platform is not merely a marketing announcement. It brings with it two concrete technical components, OpenShell and Sentry, along with an alliance of more than 100 organizations, including Anthropic, Microsoft, JPMorganChase, and Palantir. For developer and enterprise IT teams increasingly deploying autonomous agents in production environments, this step marks a turning point: AI agent security is moving from a nice-to-have to an infrastructure requirement.
Table of Contents
Image: „NVIDIA Headquarters.jpg“ by Coolcaesar, licensed CC BY-SA 4.0, source: Wikimedia Commons
Key Takeaways
- NVIDIA announced the Open Agent Safety Platform on September 28, 2026, consisting of OpenShell (an open-source sandbox) and Sentry (a watchdog reference system).
- OpenShell uses kernel-level isolation on NVIDIA Vera CPUs and is freely available under the Apache 2.0 license, extensible to Arm and Intel platforms as well.
- Sentry runs directly on BlueField-4 DPUs and can stop agents that cross their boundaries within milliseconds, independent of the monitored system itself.
- More than 100 organizations, including Anthropic, Salesforce, SAP, and Scale AI, are already integrating the platform into their own products.
- Five design principles form the foundation: verifiable policies, out-of-band enforcement, control at model access, authority proportional to inspectability, and shared responsibility.
Why AI Agent Security Is Becoming a Critical Issue Now
Autonomous AI agents differ fundamentally from classic chatbots. They independently execute actions, access systems, write code, and make decisions, often across multiple steps, without a human reviewing every intermediate step. This exact autonomy makes them economically valuable and risky at the same time.
According to NVIDIA, security incidents at several leading AI labs have shown that agents can bypass application-layer security controls in order to “successfully” complete a task. The problem: application-layer controls are often based on rules the agent itself knows or can at least infer. Whoever knows the rules of the game can, under certain circumstances, also find a way around them.
NVIDIA founder and CEO Jensen Huang puts the urgency into words:
“AI’s extraordinary potential for society will only be realized if we solve AI safety… Safety and security require full-stack engineering. NVIDIA Open Agent Safety Platform brings together industry, researchers and public-sector organizations to share best practices, align on evaluation methods and foster international cooperation. Together, we can raise the bar for global AI safety.”
This statement points to a central idea: AI agent security cannot be solved solely through application-layer software patches. It requires securing the entire stack, from hardware to application.
The Two Pillars of the Platform: OpenShell and Sentry
NVIDIA OpenShell: The Sandbox with Kernel-Level Isolation
OpenShell is the open-source building block of the platform, released under the Apache 2.0 license. The source code is publicly available on GitHub (github.com/NVIDIA/openshell). OpenShell’s goal: a secure runtime environment for autonomous AI agents with kernel-level isolation.
Concretely, this means: an agent running in an OpenShell environment is strictly isolated from other processes and system resources. Even if the agent is compromised or behaves incorrectly, the damage remains confined to the sandbox.
Technically, OpenShell is built on NVIDIA Vera CPUs, which, according to NVIDIA, is the first CPU architecture purpose-built for agentic AI workloads. Importantly for practical use, the software is not limited to NVIDIA hardware. It can be extended to third-party compute platforms, including Arm- and Intel-based systems. This makes it easier for companies with heterogeneous infrastructure to get started without needing a complete hardware switch.
NVIDIA Sentry: The Watchdog in Silicon
While OpenShell secures the runtime environment, Sentry takes over continuous monitoring from the outside. Sentry is an out-of-band watchdog reference system that runs on NVIDIA BlueField-4 DPUs, specialized data processing units that operate separately from the agent’s actual compute load.
The decisive advantage of this architecture: the monitored agent doesn’t know it’s being observed, because the monitoring physically happens on a separate chip. If an agent exceeds its defined boundaries, Sentry can isolate or completely stop it within milliseconds.
Sentry is built on the NVIDIA DOCA software platform and offers the following functions:
- Real-time inspection of agent requests and responses
- Attested telemetry, i.e., cryptographically verifiable behavioral data
- Agent identity verification
- Zero-trust access policies that fundamentally grant no implicit trust
This combination of hardware-based observation and software-enforced policy is the core of what NVIDIA calls “In-Silicon Agent Monitoring.”
| Feature | OpenShell | Sentry |
|---|---|---|
| Function | Secure runtime environment / sandbox | Out-of-band monitoring |
| Hardware | NVIDIA Vera CPU, extensible to Arm/Intel | NVIDIA BlueField-4 DPU |
| License | Open Source, Apache 2.0 | Reference system based on DOCA |
| Response time | Continuous isolation | Stop within milliseconds |
Five Design Principles for AI Agent Security
NVIDIA articulates five core principles underlying the platform’s design. They’re worth using as a checklist for any company planning its own agent infrastructure.
- Policy must be verifiable before an agent runs. Security rules must not be improvised during execution.
- Enforcement must happen out-of-band. The agent itself must not know it’s being monitored, or it could deliberately evade the monitoring.
- Access to the model is the central control point. Whoever controls access to the agent’s “brain” also holds the most effective kill switch.
- Authority should scale with inspectability. The more decision-making latitude an agent is given, the more transparently its reasoning process must be documented.
- Responsibility is shared. Labs, enterprises, and hardware providers jointly bear responsibility for secure agent systems.
These principles show that NVIDIA does not see AI agent security as a pure software problem, but as a systems question linking the hardware layer, the operational layer, and organizational responsibility.
Who’s Already on Board: Over 100 Partner Organizations
The list of participating organizations reads like a who’s who of the tech and consulting industry: Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, SpaceXAI, IBM, as well as consulting firms Accenture, Deloitte, and EY. Linux vendors Canonical and SUSE are also part of the initiative.
A few concrete implementation examples illustrate how seriously the industry is taking this issue:
Anthropic is integrating the platform into its Claude Managed Agents. Paul Smith, Chief Commercial Officer at Anthropic, explains that the agent loop deliberately runs on a server separate from the execution sandboxes. Integration with OpenShell and BlueField enables enterprises to implement strict access controls.
SpaceXAI, according to President Mike Nicolls, is using the platform for Cursor coding agents and Grok models, an indication that highly autonomous development environments also benefit from this security layer.
Scale AI is integrating the platform directly into the infrastructure layer of the Scale GenAI Portfolio, as CEO Francis deSouza notes.
Salesforce has linked OpenShell with Slack to enable visibility into agent activities and structured approval workflows, relevant for teams that deploy agents within collaboration tools.
SAP is embedding OpenShell directly into the Joule Studio runtime environment, anchoring AI agent security deep within its own enterprise software architecture.
These examples reveal a common pattern: the separation of execution and control is becoming the standard pattern for secure agent architectures.
What This Means for Businesses and Developers
Several practical implications arise from this announcement for tech teams. First: since OpenShell is open source and licensed under Apache 2.0, development teams can directly inspect, adapt, and integrate the code into their own systems without being locked into a closed NVIDIA ecosystem. Extensibility to Arm and Intel platforms further eases integration into existing, heterogeneous data centers.
Second: companies already working with partners like SAP, Salesforce, or Microsoft will likely be able to use the platform’s security features indirectly through existing software licenses in the foreseeable future, without needing to dive deep into the infrastructure layer themselves.
Third: the emphasis on zero-trust principles and attested telemetry aligns well with regulatory requirements, such as those discussed under the EU AI Act. Those who adopt verifiable, inspectable agent architectures early are likely to find it easier to meet future compliance requirements.
Conclusion: AI Agent Security Becomes an Infrastructure Issue
The NVIDIA Open Agent Safety Platform marks a turning point in the discussion around AI agent security. Instead of implementing security controls solely at the application layer, NVIDIA, together with more than 100 partner organizations, is shifting control to deeper system layers: kernel isolation through OpenShell and silicon-based monitoring through Sentry.
For developers and enterprise IT leaders, this suggests a clear next step: review the OpenShell source code on GitHub, evaluate your own agent infrastructure for out-of-band monitoring capability, and watch which of the named partners, such as SAP, Salesforce, or Microsoft, integrate the platform into products already in use at your organization. Those who start rethinking security architectures for autonomous agents now avoid having to retrofit them later under time pressure.
Sources
- NVIDIA Newsroom (2026): “Open Agent Safety Platform”. https://nvidianews.nvidia.com/news/open-agent-safety-platform
- NVIDIA Developer Blog (2026): “NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring”. https://developer.nvidia.com/blog/nvidia-open-agent-safety-platform-a-reference-for-continuous-in-silicon-agent-monitoring
