NVIDIA Open Agent Safety Platform is a new software-and-hardware security architecture announced on September 28, 2026. It combines NVIDIA OpenShell, an open-source runtime that restricts what autonomous AI agents can access, with NVIDIA Sentry, an optional, hardware-isolated monitoring and enforcement layer designed around BlueField-4 data processing units (DPUs).
NVIDIA says the objective is to move critical controls outside the AI model and the agent’s own application. Instead of relying only on an instruction such as “do not access production data,” an operator defines permissions that a separate runtime enforces. For infrastructure with Sentry, an additional watchdog monitors the agent from an isolated trust domain. NVIDIA says Sentry can quarantine an agent attempting to cross its established boundary in milliseconds; this is a company-described architectural capability, not an independently established guarantee for every deployment.
The announcement arrives as developers increasingly give agents long-running tasks, external tools, credentials and access to production systems. The central question is no longer only whether an AI model generates an appropriate response. It is whether the surrounding infrastructure can prevent an unauthorized action even when the agent attempts one.
At a glance: OpenShell is available as open-source software today. Sentry is described as a supplementary reference-system design for supported BlueField-4 infrastructure, not as a mandatory prerequisite for running OpenShell. The announcement also includes collaboration with Anthropic and other software, infrastructure and robotics companies. Source: NVIDIA’s September 28 announcement.
What did NVIDIA announce on September 28?
NVIDIA introduced the Open Agent Safety Platform as a coordinated way to apply rules to AI agents from testing through deployment. The architecture crosses three levels: the application, the agent runtime, and the infrastructure beneath it. An organization can use the software runtime by itself or add the independent hardware-monitoring component where its systems support it.
| Component | Role in the architecture | What to understand |
|---|---|---|
| OpenShell | Isolates agent workloads and enforces file, process, network and service-access policies. | Open-source runtime; available now. Does not require BlueField-4. |
| Sentry | Observes and enforces policies from a host-independent security domain. | Additional reference-design layer based on BlueField-4 DPUs. |
| DOCA | Supplies programmable capabilities for the BlueField security layer. | Supports inspection, identity-related checks and telemetry in NVIDIA’s design. |
| Vera CPU | Compute platform optimized for sandboxed agent workloads. | A performance-oriented implementation target, not a universal requirement for OpenShell. |
That distinction between a downloadable runtime and a hardware-backed reference architecture matters. “Open Agent Safety Platform” names the broader design; it should not be mistaken for a single plugin that makes every AI agent safe after installation.
How NVIDIA OpenShell controls an AI agent
NVIDIA OpenShell places an enforceable boundary around an agent’s execution environment. The operator specifies what resources the agent needs, while a sandbox and controls outside the workload mediate the agent’s actions. NVIDIA’s technical walkthrough of OpenShell 0.1.0 describes three cooperating components: a gateway for managing sandboxes and policies, a supervisor that evaluates outbound requests, and the sandbox in which the agent runs.
That architecture addresses a practical weakness of prompt-only restrictions. If an agent receives a malicious document or decides it needs an unapproved tool, the agent’s own textual instruction is not the final authority. The surrounding runtime can reject a disallowed file operation, network connection or service request.
OpenShell documents controls in several categories:
- Filesystem: restrict which locations can be read or modified.
- Processes: run workloads with reduced privileges and limit their system capabilities.
- Network: check destinations, ports and, for supported inspected protocols, request-level operations.
- Credentials: keep real service secrets outside the agent workload and attach them only to approved destinations.
- Policy changes: analyze proposed new permissions before they are applied, with human review available for escalations.
For example, an agent may need to read information from a repository but should not be permitted to write to it. A properly configured, inspected read-only API policy can allow the retrieval while denying the write request. This is a permission enforced by the execution environment, rather than a request that the model voluntarily refrain from writing.
That also connects the announcement to Vynula’s existing coverage of AI agent guardrails and agent network security: the new story is about a specific vendor implementation of security principles already important to production agent engineering.
What does NVIDIA Sentry add on BlueField-4?
OpenShell runs alongside the agent workload, but large operators may want another control plane that a compromised host or agent cannot directly administer. NVIDIA Sentry is NVIDIA’s answer to that requirement: an out-of-band watchdog in the Open Agent Safety Platform reference design, running on a BlueField-4 DPU.
In NVIDIA’s design, the DPU observes agent-related activity from an isolated security domain and uses DOCA capabilities to connect observations with policies, identity and permitted access. This gives operators another way to investigate suspicious behavior and intervene when the agent tries to operate outside its assigned scope. NVIDIA describes the ability to quarantine and stop such activity on a millisecond time scale.
The placement of this extra layer is central to the idea. NVIDIA’s reference architecture article explains that, in its Vera Rubin POD configuration, BlueField-4 can occupy a position along the path to the model. That creates an observation and enforcement point separate from the agent and its host software.
However, Sentry does not remove the need to define sensible access policies, maintain the host, or assess application-specific risks. Hardware isolation strengthens a boundary; it does not make a mistaken authorization policy correct.
NVIDIA Open Agent Safety Platform: OpenShell vs. Sentry
The two parts perform complementary jobs rather than duplicating one another.
| Question | OpenShell | Sentry |
|---|---|---|
| Where does it operate? | Agent execution/runtime environment | Separate BlueField-4 security domain |
| Main role | Apply declared permissions to the workload | Observe and enforce independently of host software |
| Can it be used on its own? | Yes, on supported compute environments | Described as an optional additional layer in NVIDIA’s reference design |
| What problem does it address? | Unwanted file, process, network and service access | Need for a watchdog outside the agent’s direct control |
| Does it decide whether a user’s goal is ethical or correct? | No | No |
That final row matters. The platform is primarily an execution-boundary and security-governance architecture. It should not be confused with a comprehensive solution to hallucinations, deception, unsafe task selection or every form of model misalignment.
Why model guardrails alone are not enough
Traditional safeguards can influence how a model responds, and application code can refuse certain calls. But a sufficiently capable agent may run code, create child processes, interact with tools, request broader permissions, or encounter untrusted instructions during a lengthy task. Security cannot depend entirely on what the agent says it intends to do.
Consider an illustrative incident: a coding agent has permission to inspect a staging environment, and a file it reads includes instructions urging it to send a configuration file to an external endpoint. A language-model safeguard might identify the instruction as suspicious, but the execution layer provides a different kind of protection. If that endpoint is not authorized, the outbound request should be blocked independently of the model’s reasoning.
This is a defense-in-depth case, not proof that every attack is prevented. The team still needs a suitable allowlist, secret minimization, a review process for permission expansion, monitoring and an AI agent incident-response plan. Prompt injection through connected documents and tools also remains an important risk, as covered in Vynula’s agent supply-chain security guide.
Who is participating in NVIDIA’s new platform?
NVIDIA says more than 100 organizations are working with the platform’s technologies across AI models, enterprise software, infrastructure, finance and robotics. These relationships have different forms; being named as an ecosystem participant does not mean every company has completed the same production deployment.
The September 28 announcement identifies several concrete examples:
- Anthropic: work to add security controls around Claude Managed Agents’ execution sandboxes.
- Salesforce and Slack: integration that allows teams to view activity and audit events and approve or reject additional permission requests through Slack.
- SAP: work involving OpenShell and Joule Studio runtime, with engineering contributions and interoperability efforts.
- Scale AI: incorporation of platform technologies into enterprise and government agent infrastructure.
- Robotics participants: companies such as Figure and Gecko Robotics are exploring controls for agents whose actions can affect physical systems.
These cases show why the security boundary matters to different buyers. A coding assistant, a business-process agent and a robot do not share identical threat models. They do share a need to define authority and to enforce limits somewhere outside the agent’s own instructions.
Availability: what developers can use today
Developers can explore OpenShell now through NVIDIA’s public GitHub repository and platform overview. The project is published under the Apache 2.0 license. NVIDIA’s September technical materials describe OpenShell 0.1.0 and its sandboxing, credential protection and policy-verification features.
OpenShell is not restricted to a BlueField-4 deployment. NVIDIA documents support for alternative compute environments and discusses extensibility beyond its own CPUs. Sentry, meanwhile, is the optional DPU-backed security architecture for environments seeking the additional isolated layer.
For a team evaluating it, a sensible first step is a limited pilot with a non-production agent and a minimal permission policy. Verify that allowed operations work and that representative denied operations actually fail. Then examine audit trails, approval behavior, credential handling and performance before moving toward higher-impact workflows.
What teams should test before trusting it in production
Vynula would evaluate the Open Agent Safety Platform against the following operational questions rather than treat a vendor announcement as a completed security audit:
| Test area | Practical question |
|---|---|
| Denied operations | Can a sandboxed agent reach an unapproved address, file or write endpoint through any alternate route? |
| Credential safety | Can the workload or generated code reveal, reuse or redirect a protected secret? |
| Permission escalation | Who may authorize broader access, and can an agent influence that decision? |
| Subagent behavior | Do spawned processes and delegated tasks remain within effective limits? |
| Failure modes | What happens if policy validation, telemetry or the supervising service fails? |
| Auditability | Can operators explain why a request was allowed or rejected after the fact? |
| Overhead | What latency and operational costs appear under a representative workload? |
These are editorial evaluation criteria, not results from independent Vynula testing. We have not conducted a laboratory assessment of OpenShell or Sentry, and NVIDIA’s performance or response-time statements should be validated against the specific environment in which the platform will be deployed.
Vynula analysis: the security perimeter is moving outside the model
The deeper development in NVIDIA’s announcement is architectural. For several years, many conversations about AI safety centered on whether the model could be trained or instructed to decline a harmful request. Autonomous agents create a second question: what can the model actually do if it declines incorrectly, misunderstands a goal or encounters malicious instructions?
NVIDIA is proposing that agent permissions become explicit infrastructure objects. The operator sets the boundary; OpenShell enforces it around the workload; Sentry can add an independent observation and intervention point on compatible hardware. This resembles established zero-trust and workload-isolation ideas applied to a new class of software that selects actions dynamically.
There is also a commercial implication. If agent execution becomes a standard workload in enterprise computing, runtime governance may grow into a platform requirement alongside observability, identity, orchestration and networking. NVIDIA is positioning its CPU, DPU and open-source software stack within that possible infrastructure layer. This is Vynula’s interpretation of the strategy, not a demonstrated forecast of adoption.
The most constructive takeaway for builders is practical: give agents the minimum access they need, enforce that authority beyond the prompt, review expansions and retain evidence of what happened. OpenShell and Sentry offer one newly announced approach to implementing that principle; no single platform replaces sound application design and independent security testing.
What to watch next
- Independent assessments of OpenShell’s isolation and policy-verification behavior.
- More deployment detail for Sentry on BlueField-4, including availability and integration requirements.
- How enterprises handle permission changes as agents delegate tasks to subagents.
- Operational benchmarks for latency, failure recovery and auditing at scale.
- Open-source contributions and interoperability with existing agent frameworks and security tools.
Frequently asked questions
What is NVIDIA Open Agent Safety Platform?
It is a layered security architecture introduced on September 28, 2026. OpenShell supplies an enforceable runtime boundary for AI agents; the optional Sentry reference design adds hardware-isolated monitoring and enforcement on BlueField-4.
Is NVIDIA OpenShell open source?
Yes. NVIDIA publishes OpenShell on GitHub under the Apache 2.0 license. The project includes sandboxing, policy and service-access controls.
Does OpenShell need BlueField-4?
No. OpenShell can be used on supported environments without the Sentry layer. BlueField-4 is associated with the optional out-of-band hardware monitoring design.
Can NVIDIA Sentry guarantee that no AI agent will cause harm?
No such universal guarantee has been established. NVIDIA describes enforcement and millisecond-scale quarantine for agents attempting to exceed defined boundaries. The outcome still depends on the deployment architecture, policies, coverage and threat model.
Primary sources and further reading
- NVIDIA Newsroom — Open Agent Safety Platform announcement (September 28, 2026)
- NVIDIA Technical Blog — continuous in-silicon agent monitoring
- NVIDIA Technical Blog — runtime controls with OpenShell 0.1.0
- NVIDIA/OpenShell — open-source repository and documentation
- NVIDIA — Open Agent Safety Platform overview and FAQ
Reporting note (September 29, 2026): Product specifications and partner use cases above are attributed to NVIDIA unless otherwise stated. Sections labeled Vynula analysis or evaluation criteria are editorial interpretation, not hands-on performance testing. Featured photograph: Taylor Vick / Unsplash; illustrative, not official NVIDIA imagery.
