Nvidia spent Monday, September 28, 2026, telling the industry something that sounds obvious once you hear it: software promises are not security. The company’s newly launched Open Agent Safety Platform pairs an open-source runtime called OpenShell with a hardware watchdog called Sentry that runs on BlueField-4 data processing units, and the pitch is that an AI agent’s behavior should be policed from outside the system it runs on, not from inside the model that might be compromised, jailbroken, or simply wrong. Help Net Security summed up the philosophy in its headline: Nvidia wants AI agent safety enforced in silicon, not left to the agent itself.
That framing matters more than the product names. What Nvidia is really proposing is a shift in where trust lives in enterprise AI infrastructure, from the application layer down into the chip layer, a push the company reinforced by lining up more than 100 partner organizations behind the agent-safety effort when it launched in September 2026, according to Futurum Group’s analysis of the rollout. And that shift carries a second story underneath the launch headlines: a question about vendor dependency, unproven claims, and whether the rest of the chip industry is anywhere close to matching it.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Nvidia actually announced on September 28
The Open Agent Safety Platform has two distinct pieces, and the distinction is the entire point. OpenShell, which Nvidia shipped as version 0.1.0 in September 2026 according to Futurum Group’s analysis of the launch, is a software runtime that creates a secure boundary around an AI agent, tracing every action it takes and applying policy limits on what it can access, according to CSOonline’s coverage of the launch. It runs on Nvidia Vera, which Nvidia introduced in May 2026 as the first CPU purpose-built for agentic AI, in the reference design, but is being extended to Arm and Intel platforms, so it is not a fully closed system on its own.
Sentry is the harder sell, and the more interesting one. It is described as an out-of-band watchdog that runs on BlueField-4 DPUs, monitoring agent behavior from a separate piece of silicon rather than from within the same execution environment the agent occupies. Nvidia paired OpenShell with this BlueField-4 Sentry specifically to deliver millisecond-scale agent quarantine when the pairing shipped in September 2026, and the company says BlueField-4 itself gained that in-silicon agent monitoring capability as part of the same September 2026 rollout. Nvidia’s own materials put it plainly: “Sentry provides in-silicon security enforcement, meaning that if an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds,” according to the company’s press release distributed through GlobeNewswire.
The logic behind separating the two layers is straightforward once you think about what a compromised host looks like. If malware, a prompt injection attack, or a rogue update disables the software guardrails running on the same machine as the agent, those guardrails go down with the host. A watchdog sitting on a physically separate chip, talking over Nvidia’s DOCA software stack, which the company says ran threat detection up to 1,000 times faster than software-only methods and enforced security policy at up to 800 Gb/s as of June 2026, is supposed to keep watching and keep enforcing policy even after the thing it is watching has been compromised. It is the same basic idea behind a hardware kill switch: put the off button somewhere the thing you are switching off cannot reach.
Why the timing lines up with a rough year for agent security
Nvidia did not build this in a vacuum. CIO Dive reported that the platform arrives amid concerns about security incidents involving agents from OpenAI, Anthropic, and other companies bypassing controls that were supposed to contain them. Readers of this site have already seen a steady drumbeat of that coverage this year, from OpenAI’s disclosure of six AI safety incidents to reports of agents breaching dozens of firms for the cost of a monthly streaming subscription.
That backdrop is why Nvidia’s core argument lands even with people who are skeptical of vendor marketing: an agent that has been talked into ignoring its own instructions cannot be the last line of defense against itself. You need something outside the loop. The question raised by analysts and security researchers who have looked at the launch since Monday is whether “outside the loop” has to mean “on Nvidia’s own chip.”
The lock-in question nobody asked at the keynote
Here is the part of the story that got less attention than the milliseconds-to-quarantine headline. Constellation Research’s reporting notes that OpenShell runs on x86 and Arm and can work with third-party software and hardware, which is genuinely open. Sentry is a different animal. It is tied specifically to BlueField-4 DPUs, and the strongest enforcement claim, the one where a compromised host cannot disable its own watchdog, depends on owning that specific piece of Nvidia hardware.
That creates what amounts to a two-tier security model. Any organization can adopt OpenShell’s software guardrails on whatever CPU architecture it already runs. But the more defensible, harder-to-disable protection, the one Nvidia is using to justify the entire “silicon, not software” pitch, only exists if the buyer is also purchasing Nvidia’s networking silicon. For a company running a mixed data center with AMD Epyc CPUs, Intel Xeons, and networking gear from multiple vendors, that is a meaningful new line item on the infrastructure shopping list, not a free security upgrade.
It also reframes what a BlueField DPU is for. These parts were originally sold as network and storage offload processors, freeing up CPU cycles by handling data movement outside the host, and Nvidia has leaned on that performance story elsewhere too: its Dynamo 1.0 inference software, released in May 2026, boosted agentic inference throughput by up to 7 times. Wiring Sentry into them turns a BlueField-4 into a security control point as well as a performance accessory, which is exactly the kind of platform stickiness that turns a single product line into a reason to standardize an entire data center on one vendor’s stack.
How rivals stack up right now
One thing stands out after digging through this week’s coverage of the announcement: nobody has found a competing, generally available, out-of-band silicon watchdog purpose-built for AI agent behavior from Intel, AMD, Arm, AWS, Microsoft, or Google. That does not mean those companies are unprotected. It means their current AI agent security tools are software-layer guardrails, identity and access controls, and confidential-computing features that protect different things than what Sentry claims to do.
| Vendor | Current approach to AI agent security | Out-of-band silicon watchdog for agents? |
|---|---|---|
| Nvidia | OpenShell runtime boundary plus Sentry watchdog on BlueField-4 DPUs | Yes, in the announced reference design |
| Intel | OpenShell reportedly being extended to Intel platforms; no Intel-native equivalent to Sentry identified | No equivalent found in current reporting |
| AMD | Confidential-computing technology (SEV-SNP) protects workload memory, not agent behavior specifically | No equivalent found |
| Arm | OpenShell support for Arm platforms; TrustZone and CCA provide hardware isolation, not agent-behavior monitoring | No equivalent found |
| AWS | Software-layer guardrails and identity controls for agent workloads | No equivalent found |
| Microsoft | Named as a partner in launch coverage; no distinct silicon-level agent watchdog product identified | No equivalent found |
| Software-layer AI safety tooling; no silicon-specific agent watchdog identified | No equivalent found |
Nvidia’s real differentiation, in other words, is architectural rather than algorithmic. It has put a security observer physically outside the agent’s execution environment, which matters against a compromised runtime or an agent trying to disable its own controls. It does not automatically solve problems that live inside the permitted boundary, like a policy that was written wrong in the first place, a poisoned upstream tool the agent was authorized to call, or stolen credentials being used within the rules the agent was already allowed to follow.
The Arm angle: a data center CPU built with this exact fight in mind
It is worth reading this launch alongside Arm’s push into data center silicon this year. Readers may recall Arm’s AGI CPU aimed at AMD’s data center surge, part of a broader scramble among chip designers to own the infrastructure layer that AI workloads run on. Nvidia’s silicon-security pitch is a variant of the same competitive logic: whoever controls the chip that an AI workload cannot function without gets to define the security model, the pricing, and eventually the switching costs for anyone who wants to leave. AMD’s own data center run, covered in our report on AMD crossing the $1 trillion market cap threshold, shows how much is riding on exactly this kind of infrastructure positioning battle.
History says hardware security enclaves are a slow build, not an instant standard
Nvidia is not the first chipmaker to promise that moving security into silicon solves problems software could not. The pattern has played out at least three times before, and it is worth walking through because it tempers how fast Sentry is likely to become a default enterprise requirement.
Intel SGX: powerful, but never universal
Intel introduced Software Guard Extensions with its Core and Xeon platforms in the mid-2010s, creating encrypted, isolated “enclaves” meant to protect code and data even from a compromised operating system. It found real use in privacy-preserving computation, blockchain applications, and select cloud services, but small enclave memory limits, a difficult programming model, and a string of side-channel research findings kept it from becoming a universal enterprise standard. A decade later, SGX is a specialist tool, not a default.
AMD SEV-SNP: broader reach because it asked less of developers
AMD’s Secure Encrypted Virtualization, and later SEV-SNP, protected entire virtual machines from a hostile hypervisor rather than requiring developers to rewrite applications into enclave-shaped pieces. That lower barrier to entry is part of why Microsoft Azure and Google Cloud both built confidential-VM offerings on top of it. But SEV-SNP protects workload confidentiality and integrity, not whether the workload’s actions are authorized, which is exactly the gap Sentry is trying to fill for agents.
Arm TrustZone and CCA: broad adoption, narrow scope
Arm TrustZone has shipped in mobile, embedded, and payment hardware for years, dividing execution into secure and normal “worlds.” Arm’s newer Confidential Compute Architecture pushes that model into cloud and data center workloads. The lesson from that trajectory: hardware roots of trust get adopted broadly when cloud providers abstract them behind managed services, and adoption stalls when customers have to manage the hardware complexity themselves.
Put together, that history suggests a fairly predictable path for Sentry: adoption starts in high-value, regulated, or high-risk agent deployments, cloud providers eventually wrap it in a managed service to hide the complexity, and broad enterprise uptake only follows once tooling, attestation, and operational integration catch up. None of that happens in the first quarter after launch.
What Nvidia is claiming, and what nobody outside Nvidia has verified yet
The specific performance claims behind Monday’s launch are, so far, Nvidia’s claims. The company’s developer blog states that “from this position, BlueField-4 provides continuous, out-of-band observability into agent behavior and enforces security policies in real time at line speed,” according to Nvidia’s own developer blog post. On its official social account, Nvidia framed the split plainly: “NVIDIA OpenShell enforces it while the agent runs,” and “teams can add NVIDIA Sentry on BlueField-4 for independent monitoring and enforcement,” the company said in a post from its NVIDIA AI account. The same post added a line that gets at the core design philosophy: “The security policy has to keep working through all of that,” referring to scenarios where the host or the agent itself has been compromised.
What is missing, as of this week, is independent testing. No third-party penetration test, academic evaluation, or named security researcher has published results confirming the milliseconds-to-quarantine figure, the false-positive rate, or how Sentry behaves against an attacker who tries to spoof or disable telemetry before it reaches the watchdog. Coverage from SecurityWeek describes the architecture faithfully but, like most launch-day reporting, repeats Nvidia’s own language rather than independently verifying it. That is not unusual for a same-day product announcement, but it is worth flagging clearly: right now, the strongest claims about Sentry’s effectiveness are unaudited.
Open questions a hardware watchdog does not automatically answer
Several practical questions sit underneath the announcement and will determine whether Sentry becomes a real enterprise control or a marketing footnote. What exactly does Sentry monitor: network calls, system calls, tool invocations, model outputs, or all of them? How are policies represented, and who verifies they are correct in the first place? Can an agent still cause damage using a tool or credential it was legitimately authorized to use, a scenario that stays entirely inside the “software boundary” and therefore never triggers the watchdog? What does “quarantine” mean in practice: network isolation, process termination, credential revocation, or something else? And what is the added latency at scale, across a fleet of agents running simultaneously, rather than in a controlled demo?
None of these questions invalidate the underlying idea. An out-of-band hardware observer is a genuinely different security posture than a software guardrail running next to the thing it is guarding, and it directly addresses one real failure mode: an agent or its host disabling its own controls. But it does not, by itself, prove that an agent’s authorized actions are safe, that its tools are trustworthy, or that the policy it is being held to was written correctly.
The AI agent incident backdrop that makes buyers receptive
Nvidia’s timing benefits from a year of uncomfortable headlines about agents doing things they were not supposed to. This site has covered several: agents generating a million links to trick CAPTCHA systems, Nvidia’s own claim that its safety software could have stopped a major Hugging Face-related breach, and the broader pattern of attackers using AI agents to cut the cost of running a breach down to a few dollars per company. Each of those stories independently reinforces the argument Nvidia is making: agent-driven security failures are becoming common enough, and cheap enough to execute, that enterprises are being asked to treat “the agent will follow its instructions” as a bet they cannot afford to make alone.
That does not mean there is a clean, independently verified dataset of 2026 agent-related breaches to point to. What exists is a steady accumulation of individual incidents, each covered separately, that together create the demand environment Nvidia’s sales pitch is built for. Whether that demand converts into BlueField-4 purchase orders at scale is a separate, unanswered question, since no independent market researcher has yet published shipment, revenue, or attach-rate figures specific to the security use case.
Historical hardware security adoption timeline
The table below lines up the launch-to-broad-adoption pattern of prior hardware security technologies against where Sentry stands today, based on the public record for each technology’s rollout.
| Technology | Vendor | What it protects | Adoption pattern |
|---|---|---|---|
| SGX | Intel | Application code and data enclaves | Niche use in privacy computing and blockchain; never became a universal enterprise default |
| SEV-SNP | AMD | Whole virtual machine confidentiality and integrity | Broader reach via Azure and Google Cloud confidential-VM offerings |
| TrustZone / CCA | Arm | Secure vs. normal world execution isolation | Widespread in mobile and embedded; CCA extension into cloud still maturing |
| Sentry | Nvidia | Out-of-band monitoring and quarantine of AI agent behavior | Just launched (September 28, 2026); no independent adoption or effectiveness data yet |
What this means for enterprise buyers weighing infrastructure decisions
For a chief information security officer evaluating this today, the practical calculus is not whether silicon-level enforcement is a good idea. It obviously has merit against certain attack patterns. The calculus is whether the specific benefit Sentry offers over the OpenShell software layer alone is worth standardizing part of the data center on BlueField-4, versus waiting for either independent validation, a managed-service version from a cloud provider, or a competing approach from Intel, AMD, or Arm. Organizations already heavily invested in Nvidia’s GPU and networking stack have the least friction here. Organizations running a mixed fleet face a genuine build-versus-buy-versus-wait decision.
Predictions: where this goes from here
Based on the launch details, the competitive gap identified above, and the historical adoption pattern of comparable hardware security technologies, a few outcomes look likely over the next 12 to 18 months.
- Independent security researchers will publish the first third-party assessments of Sentry’s quarantine claims within roughly six months, and those results will almost certainly be more qualified than Nvidia’s own marketing language.
- At least one of Intel, AMD, or Arm will announce a competing silicon-level agent-monitoring reference design within the next year, rather than ceding the “security control point” narrative to Nvidia’s DPU line entirely.
- Cloud providers will move faster than individual enterprises, wrapping Sentry-style enforcement into managed agent-hosting services so customers get the protection without managing BlueField-4 hardware themselves.
- OpenShell’s software layer will see meaningfully faster adoption than Sentry’s hardware layer, simply because it does not require a new hardware purchase, mirroring how SEV-SNP outpaced SGX by asking less of adopters.
- Regulatory and compliance frameworks for agentic AI, still being drafted in multiple jurisdictions, will start referencing out-of-band monitoring as a best practice, which would accelerate demand regardless of how the Intel-AMD-Arm competitive response plays out.
The bottom line on Nvidia’s silicon security bet
Nvidia’s argument is hard to dismiss: agents that can be tricked into ignoring their own instructions cannot be the last line of defense against themselves. Moving that last line of defense onto separate silicon is a legitimate response to a real problem, one that a growing pile of 2026 agent-security incidents has made increasingly difficult to shrug off. But the launch also does something Nvidia’s marketing did not dwell on: it makes a case for why enterprises should deepen their dependence on Nvidia-specific hardware to get the strongest version of that protection, at a moment when no independent test has yet confirmed the headline claims, and no rival chipmaker has shipped anything comparable. History suggests the software half of this platform will spread fast, and the hardware half will take years to become a real enterprise default, if it ever does.
Frequently asked questions
What is Nvidia’s Open Agent Safety Platform?
It is a security architecture Nvidia launched on September 28, 2026, combining OpenShell, an open-source software runtime that sandboxes AI agents and enforces access policies, with Sentry, a hardware watchdog running on separate BlueField-4 DPU silicon that monitors agent behavior independently of the host it runs on.
What is the difference between OpenShell and Sentry?
OpenShell is the software layer, running on the same system as the agent, enforcing policy while the agent is active. Sentry is the hardware layer, running out-of-band on a BlueField-4 DPU, so it keeps monitoring and can quarantine an agent even if the host itself has been compromised.
Do I need Nvidia BlueField-4 hardware to use this platform?
OpenShell’s software runtime is being extended to Arm and Intel platforms and does not require Nvidia-specific hardware. Sentry’s out-of-band watchdog functionality, however, is tied to BlueField-4 DPUs in the current reference design, so the strongest enforcement claim depends on owning that specific Nvidia hardware.
Do any rivals offer a similar hardware-based AI agent watchdog?
As of this week, reporting on the launch has not identified an equivalent, generally available, out-of-band silicon watchdog purpose-built for AI agent behavior from Intel, AMD, Arm, AWS, Microsoft, or Google. Those vendors offer software-layer guardrails and confidential-computing features that address different parts of the security problem.
Has Sentry’s milliseconds quarantine claim been independently verified?
Not yet. The figure comes from Nvidia’s own press release and blog posts. No third-party penetration test, academic evaluation, or named independent security researcher had published results confirming or challenging that claim as of this week.
How does this compare to older hardware security technologies like Intel SGX?
Intel SGX and AMD SEV-SNP protect the confidentiality and integrity of code, data, or virtual machines, but neither determines whether an AI agent’s actions are authorized. Sentry is aimed specifically at agent behavior monitoring and policy enforcement, a different and newer category of problem than what those earlier hardware security enclaves were built for.
Why did Nvidia launch this now?
The launch follows a string of 2026 reports about AI agents from multiple companies bypassing the controls meant to contain them, creating enterprise demand for a security layer that does not rely solely on the agent’s own instructions or software running on the same host it could compromise.
