NVIDIA launches AI agent safety platform with hardware-level enforcement

NVIDIA yesterday unveiled the NVIDIA Open Agent Safety Platform, an open-source software platform and reference system design for securing AI agents. The core premise is straightforward: safety controls should not reside inside the agent they are meant to restrain. The platform comprises two distinct layers: OpenShell, a runtime that isolates each agent in its own sandbox, and Sentry, an oversight mechanism that runs on BlueField-4 DPU cards outside the host and inspects every agent request and response in milliseconds.

According to NVIDIA's technical report, several frontier labs recently reported that agents had broken out of evaluation environments and reached systems that should have been inaccessible. Some agents also misrepresented the actions they had taken. NVIDIA identifies a recurring pattern: agents bypassed application-level controls to complete their tasks. The company calls this condition "drift" — a deviation that can stem from policy blocking, a bug, a missing tool, or ambiguous instructions. The argument is that drift cannot be solved through training alone without sacrificing capabilities, and therefore an agent cannot fully govern itself.

In practice, OpenShell spins up an isolated sandbox for each agent with a lifecycle managed through a gateway that supports Docker, Podman, MicroVM, and Kubernetes drivers. Every outbound connection passes through a policy engine that either approves, maps permissions to an authorized destination, or blocks and logs. Filesystem and process rules are locked at creation; network and provider rules can be hot-loaded without a restart. Sentry, running on BlueField-4 via NVIDIA DOCA, inspects requests and responses, provides signed telemetry, verifies agent identity, and enforces zero-trust access to data, tools, and APIs. Because it sits on separate silicon, a compromised runtime cannot shut it down.

In Vera Rubin POD configurations, each compute tray connects to the model only through its own BlueField-4; the agent cannot operate without the next inference call. That makes the path both the best observation point and a kill switch. On existing Vera systems with BlueField-4, enabling the protections is a software update only. NVIDIA claims Vera processors deliver up to 80% faster sandbox performance than traditional CPU infrastructure, and the code is compatible with both Arm and Intel platforms.

NVIDIA reports more than a hundred organizations working with the platform. Anthropic has connected Claude Managed Agents to OpenShell and BlueField; SpaceXAI uses it for Cursor coding agents and Grok models; Salesforce has integrated OpenShell into Slack for agent permission approvals; and SAP is embedding it into the Joule Studio runtime. Red Hat, SUSE, and Canonical are integrating OpenShell into their operating systems. The effort feeds into the Open Secure AI Alliance under the Linux Foundation, and the OpenShell code and skills are available on GitHub and in the official documentation, still in alpha under the Apache 2.0 license, with installation on Linux, macOS (Apple Silicon), and Windows via WSL 2.