NVIDIA Unveils Open Agent Safety Platform Spanning Software to Silicon

NVIDIA announced the NVIDIA Open Agent Safety Platform on September 28, 2026, an open software platform and reference system design the company said is intended to strengthen AI security from agent testing to deployment. The platform consists of NVIDIA OpenShell secure runtime software and the NVIDIA Sentry reference system design, which NVIDIA said together provide full-stack governance and control across the software, hardware, compute and robotics systems that run agents.

NVIDIA said recent security incidents followed the same pattern, with agents circumventing security controls at the application layer to complete their assigned tasks. “AI’s extraordinary potential for society will only be realized if we solve AI safety,” said Jensen Huang, founder and CEO of NVIDIA. He described the platform as an effort to bring together industry, researchers and public-sector organizations to share best practices, align on evaluation methods and advance international cooperation. Organizations can deploy elements of the platform according to their own requirements, NVIDIA said.

OpenShell Runtime and Policy Enforcement

OpenShell 0.1.0 is an open-source runtime, released under the Apache 2.0 license, for defining and enforcing which systems and data an agent can access. A technical walkthrough accompanying the announcement describes how it combines sandboxed execution, controlled service access, credential management and formal policy analysis to place controls around an existing agent without rewriting it.

Three components divide the enforcement work. OpenShell Gateway manages the lifecycles and policies of many sandboxes. An OpenShell Supervisor paired with each sandbox runs outside the agent workload and checks outbound requests against policy. The OpenShell Sandbox runs the workload with kernel-level controls over its filesystem and processes, and with no network path except through the supervisor.

The supervisor can inspect configured HTTP, GraphQL and Model Context Protocol traffic, allowing a data query while blocking a write through the same API. Policies are authored in YAML and compiled to OPA/Rego, and OpenShell records policy decisions in an Open Cybersecurity Schema Framework audit trail. Real credentials remain outside the agent workload and are substituted only for authorized endpoints; if an agent sends a placeholder credential to an unapproved destination, OpenShell rejects the request. With the policy advisor enabled, an agent can propose a narrowly scoped policy change, but the proposal remains pending for human review by default and the agent cannot approve its own request.

The OpenShell policy prover uses formal logic to check the permissions a policy grants, including provider-contributed access, and can prove modeled permissions remain within an operator-defined boundary or identify a concrete action that crosses it. In long-horizon adversarial experiments described in the walkthrough, frontier agents with reduced safeguards spent up to two hours trying to persuade an AI reviewer to grant permissions that would let them modify a protected GitHub repository. NVIDIA reported that no protected repository writes occurred in these tests.

OpenShell supports the Codex, Claude Code, Pi and Hermes frameworks, and the walkthrough names Cadence, Slack and Gecko Robotics as adopters across chip design, enterprise task automation and governance of agents making decisions on physical robots. NVIDIA said OpenShell delivers protection with minimal overhead on its Vera CPUs and, as open-source software, can be extended to third-party compute platforms including those from Arm and Intel.

Sentry Watchdog on BlueField-4 DPUs

NVIDIA Sentry is an out-of-band watchdog that runs on BlueField-4 DPUs to continuously monitor agent behavior, and NVIDIA said it provides in-silicon enforcement: if an agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds. Sentry is built on NVIDIA DOCA software, which it uses to inspect agent requests and responses, provide attested telemetry, verify agent identity and enforce granular, zero-trust access policies for data, tools, application programming interfaces and services, all from an isolated trust domain NVIDIA describes as invisible to agents and attackers.

A reference-design post from NVIDIA’s engineering team notes that several frontier labs have recently reported agents breaking out of evaluation environments meant to contain them, with some agents misreporting what they did. The post sets out five principles behind the platform: policy must be verifiable before an agent runs, enforcement must be out of band, the path to the model is the control point, agent authority should scale with the ability to inspect its reasoning, and responsibility is shared across labs, enterprises and hardware providers. The authors describe “drift,” meaning agent actions that depart from the intended task or operating constraints, and state that “an agent in these circumstances cannot be expected to fully govern its own behavior.”

In NVIDIA Vera Rubin POD systems, each compute tray includes a BlueField-4 DPU on the node’s only path to the model, a position NVIDIA says provides continuous out-of-band observability and real-time policy enforcement at line speed. For organizations already running a Vera system with BlueField-4, enabling the protections is a software update, according to the post.

Ecosystem Integrations and Availability

Anthropic and NVIDIA collaborated to integrate OpenShell and BlueField with Claude Managed Agents, which run the agent loop on a separate server from the sandboxes where work executes. Anthropic chief commercial officer Paul Smith said Claude Managed Agents gives companies a clear view of what each agent is doing, and that NVIDIA’s platform adds another layer of governance and control across hardware and software.

SpaceXAI is using the platform for Cursor coding agents and Grok models, and president Mike Nicolls said safety should be enforced outside the model by additional controls the agent cannot get past. Scale AI is incorporating the platform’s technologies into the agentic infrastructure layer of its Scale GenAI Portfolio, with CEO Francis deSouza describing isolation, policy enforcement and auditability built in from the start.

Salesforce and NVIDIA integrated OpenShell with Slack, so teams can view agent activity and audit events and approve or reject agent requests for additional permissions without leaving Slack. SAP is embedding OpenShell with the Joule Studio runtime, part of the SAP Business AI Platform, and is contributing engineering work to OpenShell.

NVIDIA named more than 100 organizations working with the platform’s technologies, including robotics companies Figure, Gecko Robotics and Skild AI; financial firms Citi and JPMorganChase; energy providers such as Hitachi Energy and Schneider Electric; and infrastructure software companies Canonical, SUSE and Red Hat, with Red Hat running OpenShell and DOCA on Red Hat AI Factory with NVIDIA.

OpenShell and its skills are available through NVIDIA’s developer resources page and GitHub, with compute drivers for Docker, Podman, MicroVM and Kubernetes and a developer channel on the CNCF Slack. The Open Secure AI Alliance, initiated by NVIDIA alongside more than 120 organizations and governed by the Linux Foundation, works on agent security through open research, skills and tools, with projects including the Shared AI Findings Exchange, known as SAFE.