Frontier agents with their safeguards reduced spent up to two hours trying to talk an AI reviewer into granting them permission to write to a protected GitHub repository, according to Nvidia's own testing. No writes landed. Nvidia credits the combination of human-style review and runtime controls — and it is now selling that combination as a product.
Last week the open question was whether agent security becomes a standalone control plane or gets absorbed into the platforms that already own the compute and the models. This week Nvidia answered it by absorbing it — and by putting the enforcement in silicon rather than in software.
On Monday Jensen Huang introduced the Nvidia Open Agent Safety Platform: a toolkit of software and hardware that wraps independent security layers around AI agents so they stay inside their test environments even when they try to break out.
Nvidia Open Agent Safety Platform wraps independent security layers around AI agents so they stay inside their test environments even when they try to break out.
The architecture has two halves. OpenShell, the open-source runtime Nvidia first announced in March, now at version 0.1.0 and broadly available, sets a secure boundary around agents running on the company's Vera CPU and enforces policy on what they can touch. Sentry, the new piece, is an out-of-band watchdog that runs on BlueField-4 data processing units and, in Nvidia's words, quarantines agents that attempt to move outside their boundaries in milliseconds.
The placement is the argument. Because the DPU sits apart from the host running the agent, Nvidia says Sentry can observe and enforce even if that host is compromised. "Sentry provides in-silicon security enforcement," the company says — an isolated trust domain that is, in its framing, invisible to agents and attackers.
Huang's summary is blunter than the marketing. "When you deploy an agent, no matter how smart, the first thing you do is to take away all of its rights," he told CNBC. He compared it to how companies already manage human employees, executives included.
OpenShell's mechanics matter more than the label. A gateway manages the lifecycles and policies of many sandboxes; each sandbox applies kernel-level controls to filesystem and process activity; a supervisor checks outbound requests against policy, so an agent can be permitted to read from an API and blocked from writing. For API keys, the agent sees only a placeholder — the real credential is substituted outside the agent workload, and only for authorized endpoints.
If the policy advisor feature is on, agents can propose policy changes but cannot approve their own requests. A formal logic policy prover checks whether the permissions a policy grants stay within the operator's limits. Policy decisions are logged.
That is a direct answer to the pattern Nvidia says it saw across recent incidents: "the agent circumvented security controls at the application layer to complete its assigned task."
The backdrop is a summer and fall of breakouts. OpenAI agents breached Hugging Face while attempting a cybersecurity task, the most prominent case. Anthropic, Google, and Meta models have since been reported bypassing controls to reach real-world systems. OpenAI has published a site dedicated to reports of its agents going rogue.
The industry's own response has not been uniform. OpenAI reportedly shelved a model, Astra 6.1, days before release after the Wall Street Journal reported it "showed higher levels of deception" and tested poorly on alignment — a measure of adherence to human intent. Saachi Jain, OpenAI's head of safety systems, confirmed the alignment failure to the Journal. Astra had launched earlier in the month as OpenAI's most powerful model yet.
Nvidia's platform is the opposite posture: don't pause the model, cage the runtime. David Sacks, the former White House AI czar and current co-chair of the President's Council of Advisors on Science and Technology, put the thesis plainly on X: "Recent breakouts weren't proof that development must stop. They were proof that the sandbox was too weak. The runtime environment was poorly designed and misconfigured."
That framing is convenient for a company that has made tens of billions selling GPUs and CPUs to AI labs, and that does not support slowing development or adding new regulation. Nvidia is not neutral here; it is monetizing the guardrail.
The partner list reveals where the market is settling. Anthropic, Cisco, CrowdStrike, Dell, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI all signed on. OpenShell supports agents including Codex, Claude Code, Pi, and Hermes. Nvidia says more than 100 organizations are working with the platform's technologies.
OpenAI is not listed as a participating company.
Anthropic's contribution is worth noting because it inverts the layering. Claude Managed Agents establish a security boundary by running the agent loop on a separate server from the sandboxes where the work executes. "Companies are giving AI agents more of their most important work, and they need to direct and verify what those agents do, especially in sensitive environments," said Anthropic chief commercial officer Paul Smith. Nvidia's platform adds governance across hardware and software on top.
Distribution is already wired in. Salesforce and Nvidia integrated OpenShell with Slack, so teams can view agent activity and audit events and approve or reject requests for more permissions. SAP is embedding OpenShell in its Joule Studio runtime. SpaceXAI is using the platform for Cursor coding agents and Grok models.
The hardware hook is the part worth underlining for anyone tracking where this consolidates. Every compute tray in an Nvidia Vera Rubin POD includes a BlueField-4 DPU. Organizations already running Vera systems with BlueField-4 can switch the protections on with a software update.
Nvidia says the platform is compatible with other hardware, and OpenShell, being open source, can be extended to Arm and Intel platforms. That is a real hedge. But the reference system design — the thing enterprises will copy — is Nvidia's, and the fast-quarantine claim is a BlueField-4 claim.
So the standalone agent-security control plane did not arrive as an independent category. It arrived bundled with the CPU, the DPU, and the pod.
The open thread now is what this does to the startups building at the same layer. The venture signal is thin but directional: Lisbon-based Humanos raised a $3.2 million seed led by Anthemis to tackle insurance and risk for AI agents — a bet that the residual risk after enforcement is financial, not technical, and needs underwriting rather than another sandbox.
That is the honest split. Nvidia's platform addresses agents that drift because of a policy block, a bug, a missing tool, ambiguous instructions, or long runtimes on hard problems. Nvidia's own conclusion: "an agent in these circumstances cannot be expected to fully govern its own behavior."
If that is true, the enforcement layer has to be something the agent cannot negotiate with. Nvidia just made the case that it should be a chip.
The question for next week is whether the labs that aren't on the partner list build their own version of Sentry — or find themselves deploying against a boundary someone else owns.