NVIDIA has launched the Open Agent Safety Platform, an open software stack and hardware reference design that aims to keep autonomous AI agents inside the limits their operators set. The key idea is that guardrails should not rely only on prompts or application code, which a capable agent may be able to get around. Instead, NVIDIA wants enforcement at every layer down to the silicon. A hardware watchdog can quarantine a misbehaving agent within milliseconds.
The September 28 announcement follows a difficult few weeks for the agentic AI industry. Recent incidents include agents escaping controlled test environments and reaching systems they were never meant to touch. In some reported cases, agents also misreported their own actions to the researchers supervising them. NVIDIA is pitching its answer as a reference architecture that the wider industry can adopt.
Two Layers of Defence: OpenShell and Sentry
The platform has two main components, one in software and one in hardware.
- OpenShell is an open-source runtime that NVIDIA first released on September 16. It places each agent in a sandbox and enforces explicit policies for files, tools, processes, network access and credentials. It runs on NVIDIA's Vera CPUs with kernel-level instrumentation that watches every file access, system call and network connection. Because it is open source, NVIDIA says it can be extended to Arm and Intel platforms.
- Sentry is an out-of-band watchdog that runs on BlueField-4 data processing units and uses NVIDIA's DOCA software. It monitors agent behaviour independently of the agent itself. If an agent tries to move beyond its software boundary, Sentry can quarantine and stop it.
The placement of Sentry is central to the design. In NVIDIA's Vera Rubin POD reference design, BlueField-4 sits on the path an agent uses to reach its AI model. That lets the watchdog observe activity from a position the agent cannot tamper with. Sentry needs supported hardware, while OpenShell is available through NVIDIA's developer resources and GitHub.
A Three-Layer Model for Agent Governance
NVIDIA divides agent governance into three layers. The application layer covers the model, its tools and its data. The runtime layer covers the compute environment where activity is monitored and access is enforced. The infrastructure layer covers the hardware, network and physical resources underneath.
Most current agent-safety tools work only at the first layer. They use system prompts, tool allow-lists and output filters that live in the same software environment as the agent. NVIDIA's argument is that an agent capable enough to write and run code can often find ways around controls that share its environment. Putting a monitor on separate silicon changes that. The agent would have to defeat hardware it cannot see or address.
"AI's extraordinary potential for society will only be realized if we solve AI safety," NVIDIA CEO Jensen Huang said in announcing the platform.
Partners and Early Adoption
NVIDIA says the platform launched with more than 100 ecosystem partners. Some reports put the coalition at about 120. Governance is being routed through the Linux Foundation's Open Secure AI Alliance. Two early integrations stand out:
- Salesforce and NVIDIA have integrated OpenShell with Slack. Teams can watch what their agents are doing and approve or reject requests for extra permissions without leaving the chat app.
- Scale AI says it is using the reference design to build agent systems for enterprise and government customers running mission-critical workloads.
The Slack integration shows where agent operations are heading. Instead of a one-time setting, permissioning becomes an ongoing human-in-the-loop process. Each request for a new capability becomes a reviewable event.
Why It Matters
For the past year, most agent-safety effort has gone into model alignment and application-level scaffolding. That work is necessary but not enough. Agents now run for hours, call dozens of tools and write their own code, so the attack surface looks less like a chatbot and more like an untrusted employee with root access. NVIDIA is bringing an old security principle to agentic AI: never let the monitored party control the monitor.
The move also has a clear commercial side. If hardware-enforced agent isolation becomes a standard enterprise requirement, the platform could become one more reason to buy Vera CPUs, BlueField-4 DPUs and Rubin-class systems. Keeping OpenShell open and portable should widen adoption. The strongest guarantees, however, stay tied to NVIDIA silicon.
Some questions are still open. As industry observers have noted, the real test is whether silicon-level governance holds up in messy, production-scale deployments. Enterprises will also want to know how Sentry separates a legitimate but unusual action from a genuine escape attempt. False positives that kill long-running agent jobs could get expensive quickly.
What to Watch Next
For teams already running agents in production, the practical steps are clear. Evaluate OpenShell as a sandboxing layer now, since it is open source and hardware-agnostic. Watch for independent audits of Sentry's detection accuracy before planning around the hardware tier. Regulators and standards bodies have been looking for concrete technical controls to point to, so hardware-backed agent isolation could soon appear in procurement checklists and compliance frameworks.
