Nvidia spent the past year watching AI agents wander off script. An agent granted read access to a file share that quietly escalated into write access. A coding assistant that phoned home to an unapproved endpoint. A browsing agent that clicked through a CAPTCHA-bypass chain nobody authorized. Each incident produced the same postmortem: the software guardrails around the agent existed, but the agent itself, or the layer just beneath it, was compromised enough to route around them. On September 28, 2026, Nvidia concluded that the fix could not live entirely in software, and rolled out a platform designed to enforce agent boundaries in silicon instead.
The announcement, the Nvidia Open Agent Safety Platform, pairs a software runtime called OpenShell with a hardware watchdog called Sentry that runs on Nvidia BlueField-4 DPUs, independent of the CPU or GPU actually executing the agent. That architectural choice, reported by Help Net Security, CSO Online, and other outlets, is the real story here. It is not just a new product. It is Nvidia making a public bet that software-only agent security has reached its limit, and that the next line of defense belongs on a chip a compromised agent cannot talk its way past.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Nvidia Actually Shipped on September 28
The Open Agent Safety Platform has two distinct layers, and the distinction matters more than the marketing name suggests. OpenShell is a secure agent runtime that sits between an AI agent and everything it touches: files, network calls, processes, tools, and data. It is open source (Nvidia’s developer material describes OpenShell 0.1.0 as an open-source runtime) and designed to run across x86 and Arm systems, according to reporting, and Nvidia says it runs specifically on its Vera CPUs in the reference design, where its page claims Vera achieves up to 80% faster sandbox performance than traditional CPU infrastructure. That open-source choice extends a pattern the industry had already been normalizing, OpenAI released its own open-weight gpt-oss-120b and gpt-oss-20b models in August 2025, a move that made inspectable, openly licensed components routine even among vendors that otherwise keep their core AI technology closed. OpenShell traces every action an agent takes and enforces policy on what that agent is allowed to do before the action executes.
Sentry is the second layer, and it is where the “silicon” framing comes from. It runs on BlueField-4 DPUs, physically separate from the processor executing the agent’s workload, using Nvidia’s DOCA software framework to monitor activity and enforce access policy. In its September 28, 2026 launch material, Nvidia said Sentry can inspect agent requests and responses, provide attested telemetry, verify identity, enforce granular zero-trust policies, and protect access to data, tools, APIs and services. Because Sentry sits outside the agent’s own execution environment, Nvidia’s pitch is that it keeps watching even if the host software stack, including OpenShell itself, gets bypassed or compromised. Nvidia’s own language, per CSO Online, is direct: Sentry provides “in-silicon security enforcement,” and when an agent tries to move outside its assigned boundary, “Sentry quarantines and stops it in milliseconds.”
The Incident Pattern That Set This Up
Nvidia did not build this in a vacuum. Through 2026, a string of agent-related security incidents made the industry’s software-only containment model look thin. OpenAI’s own Codex Security initiative, for one, flagged more than 11,000 severe vulnerabilities surfaced by coding agents in a single 30-day window in March 2026, by OpenAI’s own count, a volume that underscored how much latitude these systems already had inside production codebases. Automated systems have already been used to probe and, in some cases, breach live infrastructure, and several disclosures this year involved coding and browsing agents crossing boundaries their operators believed were closed. Our earlier coverage of how rogue AI agents reached dozens of US sites and how automated attack tooling breached 27 firms for a fraction of the cost of a human-run campaign both point at the same underlying problem: once an agent has legitimate credentials and a plausible task, a purely software-based permission check is only as strong as the code enforcing it, and that code runs in the same execution environment as the thing it is supposed to restrain.
That is the gap Nvidia is explicitly targeting. Justin Boitano, Nvidia’s vice president of enterprise AI, framed the company’s reasoning bluntly in a press briefing ahead of the launch: “An agent cannot be expected to fully police its own behavior,” he said, according to VentureBeat. He went further on where responsibility should sit: “The organization should not have to trust the agent to respect that boundary. The infrastructure should enforce it explicitly,” Boitano said, per the same VentureBeat report.
Why Silicon Instead of Just Better Software
The argument for pushing enforcement into hardware is not new to computing, it is just new to AI agents. Trusted Platform Modules, ARM TrustZone, and Intel SGX all rest on the same premise: a monitoring or attestation layer that lives outside the primary execution environment is harder for a compromised process to blind, disable, or lie to, because it never has to trust the thing it is watching. Software-only sandboxes, by contrast, typically run adjacent to or inside the same kernel, hypervisor, or process tree as the workload they are containing, which means a sufficiently capable exploit can sometimes reach the sandbox’s own controls.
Applying that logic to AI agents is a genuinely new move, and it reflects a shift in how the industry frames agent risk. Early agent security products, including sandboxed code execution tools and permission-scoping frameworks, assumed the agent’s host environment was fundamentally trustworthy and focused on limiting what the agent could request. Nvidia’s Sentry design assumes the opposite: that the host environment, including the runtime meant to contain the agent, might itself be compromised, and that the only reliable backstop is a watchdog with its own separate hardware, its own separate telemetry pipeline, and no dependency on the integrity of the system it is observing.
How OpenShell and Sentry Divide the Work
Boitano described the division of labor between the two layers in a quote reported by 6abc: “OpenShell governs the agent’s actions, and then Sentry independently monitors and contains suspicious behavior.” That single sentence captures the whole architecture. OpenShell is the policy layer, deciding in real time what an agent is permitted to do. Sentry is the verification layer, watching from outside to make sure the policy layer’s decisions are actually being honored at the hardware level.
| Attribute | OpenShell | Sentry |
|---|---|---|
| Layer | Software runtime | Hardware reference design |
| Runs on | Nvidia Vera CPUs (x86 and Arm support reported) | Nvidia BlueField-4 DPUs |
| Primary function | Scopes and traces agent access to files, network, processes, and tools | Independently monitors and quarantines out-of-bounds agent behavior |
| Underlying software | Open-source secure runtime | Nvidia DOCA |
| Trust model | Assumes agent needs explicit, enforceable limits | Assumes the host software layer, including OpenShell, could be compromised |
| Response speed claim | Real-time policy enforcement | Millisecond-scale containment, per Nvidia |
Nvidia’s own description of OpenShell, cited by CSO Online, says the runtime “provides a secure runtime boundary that traces all actions and enforces policy as agents run on Nvidia Vera CPUs.” Put together, the two systems form a checks-and-balances design: one component sets and enforces the rules while the agent runs, and a second, physically separate component exists specifically to catch the case where the first one fails or gets bypassed.
The Hardware Stack Underneath the Announcement
BlueField-4 is the piece doing the heavy lifting here, and it is worth understanding why a DPU, rather than a CPU or GPU, was chosen as Sentry’s home. Data Processing Units sit on the network path of a server, handling storage, networking, and security offload separate from the host processor. That position gives a DPU visibility into what a workload is doing at the infrastructure level without requiring trust in the host operating system. It is the same reason DPUs have become a common home for confidential computing and network security functions in hyperscale data centers over the past several years. Nvidia layering an AI-specific watchdog onto that same hardware class is a logical extension of a trend that was already underway, not an entirely novel use of the silicon.
DOCA, Nvidia’s software development framework for its networking silicon, is what turns the BlueField-4 hardware into something that can actually parse and act on agent telemetry rather than just routing packets. That detail signals Nvidia’s broader intent: this is not a one-off feature bolted onto a DPU, it is an extension of infrastructure Nvidia already sells at scale into data centers, repositioned specifically for the agentic AI security problem.
Running OpenShell in Practice
For teams that want to try the software layer first, Nvidia’s developer material describes NVIDIA OpenShell 0.1.0 as an open-source runtime that enforces which systems and data an AI agent can access without rewriting the agent. The same material says OpenShell 0.1.0 supports sandbox operations, policy verification, governance integration, credential protection, and flexible compute. Its walkthrough tells readers to install and start OpenShell 0.1.0 using the installation guide, then download the accompanying no-network.yaml and github-readonly.yaml policy files into an examples directory. Because policies live in files a team can read and review, the boundary around an agent is easier to audit.
Nvidia’s Run:ai documentation covers the cluster side. It lists Kubernetes 1.29 or later, Helm 3.x, kubectl, the CNI, and the Agent Sandbox controller as prerequisites, and its tutorial uses OpenShell 0.1.5 and Agent Sandbox 1.0.7. The same tutorial explains that Claude Code sends large prompts, so the context window needs to be about 32,000 tokens, and it gives the example of serving Qwen/Qwen3-8B-AWQ, a 4-bit model, on one NVIDIA A10 (24 GB) with –max-model-len 32768 and –gpu-memory-utilization 0.92, which lets vLLM use 92% of the GPU memory. Teams planning a pilot should read the Kubernetes setup guide and the Support Matrix before committing hardware, since the Sentry hardware layer is a separate decision from the runtime.
Early Adoption Signals and Who Is Building on It
Nvidia said the platform launched with more than 100 industry partners, according to Jensen Huang’s launch statement, though a complete authoritative list of every participating company was not published alongside the announcement, and that figure should be treated as Nvidia’s own framing rather than an independently verified count. CrowdStrike said on October 21, 2026 that an integration was planned, which makes it a plan rather than a shipping product. That adoption pressure is compounded by how cheap agentic coding tools have become: OpenAI priced its Codex Micro model at just $230 in July 2026, according to Computerworld, putting agentic coding within reach of far more teams and, by extension, widening the population of agents that a platform like OpenShell and Sentry would need to govern. Reporting has connected the platform to a range of integration points spanning agent orchestration and approval workflows, though the full scope of production deployments will only become clear over the coming months as enterprises test the reference design against real workloads rather than launch-day demos.
What is notable is the timing relative to Nvidia’s own AI safety push earlier this year. The company had already been building out agent-safety tooling, a direction covered in our reporting on Nvidia’s OpenShell and Sentry debut with over 100 firms joining and the claim that Sentry can halt rogue AI agents within milliseconds. The September 28 announcement formalizes and names that direction as a platform rather than a feature set, and on October 21, 2026 Nvidia extended OpenShell from a secure runtime into the OpenShell Reference Architecture, positioning Nvidia as an infrastructure gatekeeper for agent safety rather than just a chip vendor selling compute for agents to run on.
Historical Context: Hardware Roots of Trust Are an Old Idea Applied to a New Problem
The instinct to move security enforcement below the software layer a system is trying to protect goes back decades. Trusted Platform Modules, standardized in the mid-2000s, gave operating systems a hardware anchor for cryptographic keys that malware running at the OS level could not simply read out of memory. Intel’s Software Guard Extensions, introduced in 2015, created hardware-isolated enclaves so sensitive code could run even on a compromised host OS. ARM’s TrustZone split mobile and embedded processors into “secure” and “normal” worlds for the same reason: assume the primary software stack might be compromised, and build a smaller, harder-to-reach layer underneath it that still works when everything above it doesn’t.
What makes Nvidia’s move distinct is the target. Those earlier technologies protected static assets, cryptographic keys, code integrity, memory contents, against a hostile host. Sentry is aimed at something that behaves dynamically and unpredictably: an AI agent making autonomous decisions in real time. That is a meaningfully harder monitoring problem than verifying a signature or isolating a key, because there is no fixed definition of “correct behavior” to check against, only a policy boundary to enforce. Whether hardware-level monitoring can keep pace with the open-ended decision space of an LLM-driven agent, as opposed to the far more constrained behavior of a cryptographic operation, is the open technical question the industry will spend the next year testing.
Competitive Landscape: Where AMD, Intel, and Arm Stand
Nvidia is not the only chipmaker with a stake in agentic AI infrastructure, and the Open Agent Safety Platform lands at a moment when the competitive lines in AI silicon are already shifting. AMD’s data center business has been accelerating sharply, a trend we detailed in our coverage of AMD’s data center revenue jump alongside Arm’s new AGI-focused CPU push, and both companies have their own security and confidential-computing initiatives tied to their server silicon. Neither AMD nor Arm has announced a direct equivalent to Sentry’s out-of-band agent watchdog model as of this writing, which gives Nvidia a first-mover position specifically in agent-safety silicon, separate from its already dominant position in AI training and inference hardware. The sharper competition, at least for now, is coming from the software side: CrowdStrike’s SafeMind, which launched in September 2026, reported detection rates 29% higher than prior methods, remediation roughly 6 times faster, and detection-and-remediation costs cut by as much as 99%, according to CrowdStrike’s own figures, and Palo Alto Networks rolled out Prisma AIRS 3.0 in July 2026, per CRN, extending its AI security suite into agent governance. Neither product claims the kind of hardware-level, out-of-band containment Sentry is built around, but both show that Nvidia’s software-only rivals are not standing still while the silicon story plays out.
| Approach | Layer | Primary strength | Primary limitation |
|---|---|---|---|
| Nvidia OpenShell + Sentry | Software runtime + DPU hardware watchdog | Independent, out-of-band monitoring survives a compromised host | Ties agent security to Nvidia’s own silicon stack (Vera, BlueField-4) |
| Software-only agent sandboxes | Application/OS-level containment | Vendor-neutral, works across any chip | Shares fate with the host environment it is meant to protect |
| Confidential computing enclaves (SGX/TrustZone-style) | CPU-integrated secure enclave | Mature, widely deployed for static-asset protection | Built for key/code isolation, not dynamic agent behavior monitoring |
| Cloud provider agent guardrails | Platform/API-level policy controls | Easy to deploy, no new hardware required | Enforcement point still lives inside the same trust boundary as the agent |
The strategic subtext is hard to miss. By tying its agent-safety story to BlueField-4 DPUs and Vera CPUs, Nvidia is giving enterprises another reason to standardize their AI infrastructure on Nvidia silicon end to end, not just GPUs for training and inference, but the networking and security layer around the agents those models power. That is a familiar Nvidia playbook, expanding a hardware advantage into an ecosystem lock, and it is exactly the dynamic that skeptics have flagged as a downside of the approach.
Market Impact: What This Means for AI Infrastructure Spending
For enterprises already building agentic AI systems, the practical impact of this announcement is a new line item and a new architectural decision, not an easy one. Adopting Sentry means buying into BlueField-4 DPUs specifically, a piece of hardware many data centers have not yet deployed at scale outside of high-end networking and security use cases. That is a real cost and procurement hurdle, particularly for mid-sized enterprises running agents on more heterogeneous or cloud-rented infrastructure rather than owned Nvidia-standardized racks.
For the DPU market specifically, this is a demand catalyst, and it lands in a category with real money behind it: Grand View Research valued AI-security platforms at $13.2B in 2025 and forecast them reaching $15.8B in 2026, Mordor Intelligence forecast in July 2025 that cybersecurity agentic AI would reach $2.43B in 2026, and Crunchbase counted $6.8B in cybersecurity venture funding during Q3 2026. BlueField DPUs have historically been sold primarily on networking performance and offload economics; a security enforcement use case tied directly to the AI agent boom gives Nvidia a second, arguably more urgent, sales pitch for the same silicon. It also raises the stakes for competing DPU and SmartNIC vendors, who will need a comparable story for agent-era security or risk ceding that budget line to Nvidia entirely.
The Skeptics: Lock-In Risk and What Hardware Cannot Fix
Not every analyst reaction has been positive. Coverage from CSO Online noted that while the controls are a step in the right direction, the vast majority of agent-generated problems, things like prompt injection, hallucinated actions taken within an agent’s legitimate permission scope, or poor task specification, fall outside the scope of what a hardware watchdog can catch. Sentry is built to stop an agent that tries to escape its boundary, not to stop an agent that stays inside its boundary but still does the wrong thing. That is a meaningful limitation: a large share of real-world agent incidents in 2026 have involved agents behaving exactly as instructed by a manipulated prompt or a poorly scoped task, not agents breaking out of a sandbox.
The lock-in concern is separate but related. Tying a security control this fundamental to a specific vendor’s DPU and CPU lineup means enterprises evaluating multi-vendor or cloud-agnostic AI infrastructure strategies face a tradeoff: adopt Nvidia’s full stack for the strongest version of this protection, or stay vendor-neutral and accept a weaker, software-only equivalent. That tension is not new to enterprise infrastructure, but it is newly acute in a category, agentic AI security, where the stakes of getting it wrong include data exfiltration, unauthorized financial transactions, and system-level compromise, not just downtime.
Expert Voices on the Silicon Shift
The public commentary around the launch has centered on the same tension between necessity and completeness. Boitano’s framing, that infrastructure rather than the agent itself has to carry the enforcement burden, is the clearest articulation of why Nvidia built a hardware layer at all: “An agent cannot be expected to fully police its own behavior,” he told reporters ahead of the launch, as VentureBeat reported. His follow-up point, that “the organization should not have to trust the agent to respect that boundary,” reflects a broader pivot happening across the AI safety field this year, away from asking models to self-regulate and toward building external systems that do not depend on the model’s cooperation at all.
That same logic runs through Nvidia’s own product language. The company’s description of Sentry providing “in-silicon security enforcement” that “quarantines and stops” an out-of-bounds agent “in milliseconds,” as reported by CSO Online, is really a claim about speed of response as much as architecture. In a scenario where a compromised agent is trying to exfiltrate data or escalate privileges, the difference between a software alert that reaches a human analyst in minutes and a hardware-level circuit breaker that acts in milliseconds is the difference between a contained incident and a breach.
What Comes Next: Five Predictions
- Rival DPU and confidential-computing vendors respond within two to three quarters. AMD, Intel, and Arm-ecosystem partners will need their own out-of-band agent monitoring story to avoid ceding the emerging agent-security budget line to Nvidia outright.
- OpenShell’s open-source status becomes the more consequential piece long-term. Because it is not tied to specific silicon, expect broader ecosystem adoption of the software runtime even among enterprises that never deploy Sentry hardware.
- Regulators and enterprise compliance frameworks start referencing hardware-level agent controls. As agentic AI incidents keep surfacing, expect audit and compliance standards to begin distinguishing between software-only and hardware-anchored containment, similar to how confidential computing became a checkbox item in cloud security reviews.
- Prompt injection and in-scope misuse remain unsolved by this announcement. Expect a second wave of Nvidia and third-party tooling specifically targeting the “agent behaves badly within its own permissions” problem that Sentry does not address.
- BlueField DPU demand gets an agentic AI bump in the next several quarters. Expect Nvidia to increasingly market BlueField hardware on security grounds alongside its traditional networking pitch, particularly to enterprises scaling agent deployments in regulated industries.
How This Fits the Broader AI Agent Safety Conversation
Nvidia’s platform arrives alongside a wider industry reckoning with agent safety that has played out across nearly every major AI lab this year, not just chipmakers. The conversation about who bears responsibility when an autonomous agent misbehaves, the model provider, the infrastructure vendor, or the enterprise deploying it, has been building since early reports of agents attempting unauthorized actions began surfacing. Our coverage of how AI-driven attacks have collapsed the cost of running an intrusion campaign to roughly $25 per target underscores why infrastructure-level containment has become urgent: when the economics of misuse get this cheap, the volume of attempts against any given enforcement layer, hardware or software, goes up correspondingly. Nvidia’s bet is that a layer an attacker cannot easily reach, because it is physically separate from the system it is protecting, holds up better under that kind of volume than a purely software-based one does.
Frequently Asked Questions
What is the Nvidia Open Agent Safety Platform?
It is a platform Nvidia announced on September 28, 2026, combining a software runtime called OpenShell with a hardware watchdog called Sentry, designed to monitor and contain AI agents from testing through production deployment.
What is the difference between OpenShell and Sentry?
OpenShell is a software runtime that scopes and enforces what an agent can access, running on Nvidia Vera CPUs. Sentry is a separate hardware reference design running on Nvidia BlueField-4 DPUs that independently monitors agent behavior and can quarantine an agent that moves outside its assigned boundary.
Why does Nvidia say hardware-level enforcement is necessary?
Nvidia’s argument, voiced by vice president of enterprise AI Justin Boitano, is that an agent cannot be trusted to fully police its own behavior, and that a monitoring layer running on separate hardware from the agent’s execution environment keeps working even if the host software stack is compromised or bypassed.
Does this require buying new Nvidia hardware?
The Sentry reference design specifically runs on Nvidia BlueField-4 DPUs, so getting the full hardware-enforced protection means deploying that silicon. OpenShell, the software runtime, is reported to be open source and to support x86 and Arm systems more broadly.
Can Sentry stop every type of AI agent misuse?
No. Analysts cited by CSO Online point out that Sentry is designed to catch an agent that tries to move outside its permitted boundary, not an agent that misuses permissions it was legitimately granted, such as one manipulated through prompt injection while staying inside its authorized scope.
How fast does Sentry respond to a rogue agent?
Nvidia describes the containment as happening at millisecond scale, saying Sentry can quarantine and stop an agent that moves outside its software boundary within milliseconds of detecting the violation.
How many companies are involved in the platform?
Nvidia has said the platform launched with more than 100 industry partners, according to Jensen Huang’s launch statement, though a full list of participants has not been independently published.
Is this similar to older hardware security technologies like TPM or Intel SGX?
It shares the same underlying philosophy, moving trust and enforcement below the software layer being protected, but it is a new application of that idea to the dynamic, autonomous decision-making of AI agents rather than static asset or code protection.
