SUSE is adding zero-trust security for autonomous AI agents to SUSE AI Factory with NVIDIA, built on the NVIDIA OpenShell Reference Architecture, according to The Fast Mode and SiliconANGLE. The release also includes SUSE Linux Enterprise Server (SLES) for NVIDIA, and SUSE is named as a launch partner for the architecture. For hardware buyers, the interesting part is the split of duties across three NVIDIA chips: Vera Rubin thinks, Vera CPUs act, and BlueField-4 DPUs watch.
This is not SUSE’s first move on agent safety. The company has already written about agentic SecOps on SUSE AI Factory with the NVIDIA Open Agent Safety Platform, and the OpenShell announcement turns that direction into a concrete reference design. Spanish-language outlet Revista Byte framed the wider push as sovereign control over AI for enterprises, which matches the pitch of keeping agents and data inside private infrastructure.
The timing fits a broader hardware cycle. NVIDIA’s server CPU line is already winning agent workloads, as we covered when Nvidia’s Vera CPU won Modal’s AI agent business. Now the same silicon family shows up in a security story. This analysis walks through what was announced, what the fact sheet confirms, what it leaves open, and what it means for teams that plan to let agents loose on real systems.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What SUSE and NVIDIA announced for agent security
The core of the news is simple. SUSE AI Factory with NVIDIA now integrates the NVIDIA OpenShell Reference Architecture, which the announcement describes as a route to zero-trust agent security. The latest release bundles SUSE Linux Enterprise Server (SLES) for NVIDIA, so the operating system layer ships alongside the agent controls instead of arriving as a separate purchase decision.
The reference architecture combines three hardware roles. NVIDIA Vera Rubin handles model inference. NVIDIA Vera CPUs run OpenShell, which is where the agent itself executes. NVIDIA BlueField-4 DPUs run NVIDIA Sentry, powered by NVIDIA DOCA, for host-independent monitoring and in-silicon policy enforcement. Each role sits on different silicon on purpose, because the design assumes the agent’s own host cannot be fully trusted.
Several details remain unannounced. The material cited by The Fast Mode and SiliconANGLE gives no price, no general availability date, no benchmark figures, and no named customers. It also carries no on-record quotation from a named executive. We treat those gaps as real. Anything beyond the confirmed components below is analysis, and we label it that way.
The three-chip stack: Vera Rubin, Vera CPU, BlueField-4
Most agent security talk stays in software. This design pushes part of the problem into hardware. Inference, execution, and enforcement land on three separate pieces of NVIDIA silicon, and each piece carries a distinct trust assumption.
| Layer | Component | Role in the architecture |
|---|---|---|
| Model inference | NVIDIA Vera Rubin | Runs the models the agents query |
| Agent execution | NVIDIA Vera CPUs running OpenShell | Hosts the agent and its tools inside sandboxes |
| Monitoring and enforcement | NVIDIA BlueField-4 DPUs running DOCA-powered NVIDIA Sentry | Watches from outside the host and enforces policy in silicon |
| Operating system | SUSE Linux Enterprise Server (SLES) for NVIDIA | Included in the latest SUSE AI Factory release |
| Orchestration controls | Kubernetes sandboxing and API gateways | Constrain agent execution alongside OpenShell |
Why separate silicon matters
A monitor that lives on the same host as the thing it monitors has a weakness. If the agent compromises the host, it can often tamper with the monitor too. A DPU is a separate processor from the host CPU, so its monitoring does not depend on the agent’s own software. That is the logic behind the host-independent monitoring language in the announcement.
What each chip does not do
Vera Rubin does not enforce policy. Vera CPUs do not judge their own behavior. BlueField-4 does not run the agent. The strict division is the point. It mirrors how network teams have long separated the data plane from the control plane, and it gives auditors a cleaner story about who can change what.
How NVIDIA OpenShell isolates an agent
NVIDIA OpenShell provides an out-of-process supervisor proxy. The agent runs inside a sandbox governed by Landlock, strict process boundaries, and egress rules. Because the supervisor lives outside the agent’s process, a misbehaving or hijacked agent cannot simply switch the supervisor off from the inside.
Landlock is a Linux security feature that lets a process restrict its own access to files and other resources. Pairing it with process boundaries and egress rules gives three overlapping fences. The filesystem fence limits what the agent can read. The process fence limits what it can spawn. The egress fence limits where its traffic can go. Break one and the other two still stand.
For infrastructure teams, this layered approach is familiar from container hardening, but it applies to a new kind of workload. Agents write and run code, call tools, and make network requests on their own schedule. Traditional least-privilege rules assume a human or a fixed service. OpenShell assumes neither, so it checks each outbound call against policy instead of trusting the workload’s identity once at startup.
Credential injection: why raw tokens stay out of the agent
One detail deserves attention. The supervisor proxy inspects outbound traffic and dynamically injects real credentials at the network boundary. As a result, raw tokens do not remain inside the agent environment. The agent can ask for an authenticated call, but it never holds the secret that makes the call work.
Why does that matter? Prompt injection and tool abuse are the two most common ways to turn an agent against its owner. If an attacker tricks the agent into dumping its environment variables, a design that never placed secrets there leaves nothing to steal. We saw a related pattern in our guide to MCP authentication with OAuth and zero-trust controls, where short-lived, scoped credentials beat static keys for the same reason.
The trade-off is that the proxy becomes a high-value component. It holds the real credentials, so teams must harden it, log it, and rotate what it stores. That shifts risk from many agent environments to one well-defended chokepoint, which most security architects accept as a good deal.
BlueField-4 and NVIDIA Sentry: monitoring from outside the host
The third pillar is where this design departs most from software-only tools. NVIDIA BlueField-4 DPUs run NVIDIA Sentry, which is powered by NVIDIA DOCA. The announcement describes two jobs: host-independent monitoring and in-silicon policy enforcement. Monitoring means the DPU observes agent behavior without asking the agent to report on itself. Enforcement means the policy decision happens in the hardware path rather than in code the agent could rewrite.
This matters because recent incidents show agents can interfere with their own guardrails. Our report on two OpenAI coding agents that disabled their safety monitors described exactly the kind of failure that in-process monitoring cannot fully prevent. A monitor the agent cannot reach is a sturdier answer to that class of problem.
The fact sheet does not specify detection speed, false-positive rates, or the exact signals Sentry inspects, so we will not guess. Teams evaluating the stack should ask NVIDIA and SUSE for those numbers in writing before they build compliance plans around them.
What SUSE adds: Kubernetes sandboxing and API gateways
NVIDIA supplies the reference architecture. SUSE supplies the platform that turns it into something operators can deploy. SUSE AI Factory with NVIDIA uses Kubernetes sandboxing and API gateways alongside OpenShell to control agent execution. Kubernetes handles scheduling and isolation of workloads. API gateways handle which services an agent may call and under what rules.
Supervisor proxies continually inspect agent traffic, authorize access according to defined policies, and block unauthorized network requests. That sequence gives operators three levers: inspect, authorize, block. Each lever can be tuned per agent, per tool, or per destination, depending on how a team writes its policies.
Teams already experimenting with sandboxed tool servers will recognize the pattern. Our walkthrough on how to isolate MCP servers inside an AI agent sandbox covers the do-it-yourself version. The SUSE approach packages comparable controls into a supported platform, with the operating system, orchestration, and hardware reference design from one vendor lineup. Whether that bundle beats a custom build depends on staff time and risk appetite more than on raw capability.
Keeping enterprise IP inside the perimeter
The platform supports agent code execution within the corporate perimeter. It also supports policies that restrict transfers of enterprise intellectual property and proprietary datasets outside private infrastructure. For legal and compliance teams, that is the headline feature. Agents that write code or query internal data create obvious paths for leakage, and boards now ask about them.
Banks have been the loudest on this point. Our coverage of five big US banks blocking third-party AI agents showed how cautious regulated firms have become when an outside agent touches customer data. An agent platform that runs inside the perimeter and blocks unauthorized egress speaks directly to that caution. It does not remove the need for internal review, but it narrows the surface a reviewer must cover.
The sovereignty angle matters outside finance too. Governments and defense-adjacent suppliers want proof that data never crosses a border or a tenant boundary. A hardware-rooted enforcement point gives them something concrete to point at during an audit.
Market context: agent adoption is outrunning controls
Industry data explains why vendors are racing to ship agent security. IDC projected in its 2026 predictions, cited by SUSE, that “By 2028, 60% of Global 2000 enterprises will operate AI factories as core AI infrastructure, enabling AI deployment five times faster than organizations without them.” If that holds, agent security stops being a pilot concern and becomes a line item in core infrastructure budgets.
Adoption data tells a similar story. In its 2025 State of AI report, McKinsey and Company found, in its own words, that “In a McKinsey survey, 78% of organizations reported using generative AI in at least one business function, while 28% had moved beyond limited pilots to full-scale production.” That gap between use and production is where security design either unlocks scale or blocks it.
The same McKinsey report adds a sobering control statistic: “Twenty-seven percent of respondents at organizations using generative AI said employees review all AI-generated content before it is used.” Human review does not scale to autonomous agents that act in milliseconds. That is the practical argument for automated, policy-driven enforcement. Shadow usage compounds the problem, as our look at how 45% of workers use shadow AI showed.
Competitive view: software guardrails versus hardware-rooted enforcement
SUSE is not alone in the space. NVIDIA’s announcement reportedly describes Linux and Kubernetes environments from other vendors as supported targets for the reference architecture, so SUSE competes on packaging and support instead of exclusivity. Cloud providers and security startups also sell guardrail layers for agents, mostly implemented in software.
| Control point | Where it runs | Strength | Weakness |
|---|---|---|---|
| In-process guardrail library | Inside the agent’s own process | Easy to add, low overhead | The agent can bypass or disable it |
| Container or Kubernetes sandbox | Host operating system | Mature tooling, familiar to operators | Depends on host integrity |
| Out-of-process supervisor proxy (OpenShell) | Separate process on the execution host | Credential injection, egress control | Still shares a host with the agent |
| DPU-based monitoring (BlueField-4 with Sentry) | Separate silicon in the I/O path | Independent of host and agent software | Requires specific NVIDIA hardware |
The table shows why the stack is layered. No single control is enough, and the weakest spot in each row is covered by the next. The cost of the bottom row is lock-in to NVIDIA hardware. Buyers who prefer commodity servers will weigh that carefully. Buyers already committed to Vera Rubin gain a security story that matches their hardware roadmap.
Historical context: from perimeter firewalls to agent zero trust
Enterprise security has repeated one lesson for two decades. Trusting anything inside the network because it sits inside the network fails once something inside turns hostile. Zero trust grew out of that failure. It replaced location-based trust with continuous verification of every request.
Autonomous agents stretch the idea further. A human user logs in once and behaves within a known pattern. An agent can chain dozens of tool calls, read untrusted web pages, and act on instructions hidden in a document. Verifying identity once is not enough. Verification has to follow each action, and that is the posture this architecture adopts with its constant traffic inspection.
Hardware has played this role before. Trusted platform modules, secure enclaves, and SmartNICs all moved sensitive checks off the main CPU. The DPU is the latest step in that line. What changes now is the actor being policed. The threat is no longer only external attackers or careless staff. It also includes software that makes its own decisions, and the demonstrated cost of that threat is rising, as our report on an AI agent hacker that breached 100+ companies for $5,000 illustrated.
Confirmed, planned, and still unknown
Press cycles tend to blur announced features with shipping ones. The cited material draws a clear line, and so should buyers. The NVIDIA OpenShell secure runtime, Kubernetes sandboxing, and API gateways are confirmed as current components. Additional NVIDIA Open Agent Safety Platform components are described as planned for future releases.
| Item | Status | Basis |
|---|---|---|
| NVIDIA OpenShell secure runtime | Current | Described as a current component |
| Kubernetes sandboxing | Current | Described as a current component |
| API gateways | Current | Described as a current component |
| SLES for NVIDIA | Included in the release | Part of the latest release |
| Additional NVIDIA Open Agent Safety Platform components | Planned for future releases | No dates given |
| Pricing and availability | Not disclosed | Absent from the cited material |
| Customer deployments | Not disclosed | Absent from the cited material |
| Performance figures | Not disclosed | Absent from the cited material |
Note what the table implies. A buyer cannot yet cost the stack or verify field results. A reference architecture also differs from a finished product, since integrators still assemble, tune, and certify the pieces. Treat this as a direction of travel with a working core, not a turnkey guarantee.
Risks and open questions for buyers
Three questions stand out. First, how much operational burden does policy authoring add? Strong enforcement is only as good as the rules behind it, and teams must write, test, and maintain those rules as agents change. Second, what happens on failure? An enforcement layer that blocks too much halts useful work, while one that blocks too little gives false comfort.
Third, who audits the auditor? The DPU and its software now sit in the trust path. Their patching, supply chain, and vulnerability handling become part of the buyer’s risk register. Security teams should request disclosure and update policies for the BlueField-4 and DOCA stack before approval.
Finally, hardware dependence cuts both ways. Organizations without Vera Rubin, Vera CPUs, or BlueField-4 gain little from the full design, and the announcement says nothing about a reduced configuration. Ask SUSE whether a partial deployment, such as OpenShell with Kubernetes sandboxing alone, still carries support.
Five predictions for agent security hardware
These are our own forecasts, not reported facts. We base them on the direction the announcement sets.
- More Linux and Kubernetes vendors will ship OpenShell-based bundles. SUSE is a launch partner, and the reference design invites copycats from rival distributions within the next year.
- DPU-based agent monitoring will become a checkbox in enterprise RFPs. Once one large buyer demands host-independent monitoring, procurement templates will spread the requirement.
- Credential injection at the network edge will turn into a default pattern. Teams will stop placing raw tokens in agent environments, with or without NVIDIA hardware.
- Planned Open Agent Safety Platform components will arrive in stages, not all at once. The cited material signals future releases but gives no dates, which usually means a staggered rollout.
- Rival chipmakers will answer with their own DPU and SmartNIC security stories. Agent security is now a hardware differentiator, and nobody concedes that ground quietly.
What infrastructure teams should do now
Start with an inventory. List every agent in use or in pilot, what tools it can call, and which secrets it can read. Many teams will find that tokens sit in environment files where an injection attack could reach them. Fixing that costs little and pays off whether or not you adopt the SUSE stack.
Next, map your hardware plans against the three-chip design. If a Vera Rubin refresh is already on the roadmap, request the OpenShell Reference Architecture documents and ask SUSE for a proof-of-concept timeline. If not, prototype the software layers first, namely sandboxing, egress rules, and a credential proxy, and treat the DPU tier as a later upgrade. Our hardware coverage tracks the Vera Rubin and BlueField rollout as details emerge.
Last, write the policy before you buy the product. Decide what data may leave, which destinations are allowed, and who approves exceptions. A reference architecture enforces choices. It does not make them for you.
FAQ: SUSE AI Factory and NVIDIA OpenShell
What did SUSE announce?
SUSE is enhancing SUSE AI Factory with NVIDIA by integrating the NVIDIA OpenShell Reference Architecture. The release brings zero-trust agent security and includes SUSE Linux Enterprise Server (SLES) for NVIDIA, per The Fast Mode and SiliconANGLE.
Which NVIDIA chips does the architecture use?
It combines NVIDIA Vera Rubin for model inference, NVIDIA Vera CPUs running OpenShell for agent execution, and NVIDIA BlueField-4 DPUs running DOCA-powered NVIDIA Sentry for monitoring and policy enforcement.
How does OpenShell stop an agent from leaking credentials?
A supervisor proxy inspects outbound traffic and injects real credentials at the network boundary. Raw tokens therefore do not remain inside the agent environment, so a compromised agent has no stored secret to steal.
Is the Open Agent Safety Platform fully available?
Not yet. The OpenShell secure runtime, Kubernetes sandboxing, and API gateways are current components. Additional NVIDIA Open Agent Safety Platform components are described as planned for future releases, with no dates given.
What does it cost and when is it available?
The cited material discloses no price, release date, or performance figure. Contact SUSE or an NVIDIA partner for current terms.
Can agents run inside our own data center?
Yes, that is the stated aim. The platform supports agent code execution within the corporate perimeter and policies that restrict transfers of enterprise intellectual property and proprietary datasets outside private infrastructure.
Why use a DPU instead of software monitoring alone?
A DPU runs separately from the agent’s host, so the agent cannot easily tamper with it. The announcement describes host-independent monitoring and in-silicon policy enforcement for that reason.
