How to keep control over AI agents? The July incident, during which OpenAI’s agents compromised Hugging Face systems in a cyber evaluation, vividly illustrated the issue.
The release of NVIDIA’s Open Agent Safety Platform offers a possible answer. The manufacturer wants to be able to control the agent from a layer it does not itself control.
The approach is to move part of the controls outside the model and its harness, the software environment that turns a model into an agent by adding memory, tools, orchestration and action capabilities.
With an agent capable of modifying data, calling a service, or executing code, an error can become an unauthorized action. Security must then cover not only the model’s response but also its execution environment.
OpenShell builds a boundary around the agent
The first building block from NVIDIA is OpenShell, an open-source runtime designed to provide a secure execution boundary for agents.
It enables tracing the agent’s actions and applying policies during execution. NVIDIA presents it as a boundary located outside the model and the harness. It should allow controlling the agent’s access to files, to the network, to tools, to APIs and to services.
The agent can operate with open or proprietary models. The runtime thus provides the security boundary around it.
NVIDIA optimizes OpenShell for Vera, its CPU designed for agent workloads, but presents it as open-source software that can be extended to third-party computing platforms, notably Arm and Intel.
The manufacturer is thus not merely seeking to confine agents within its own software ecosystem.
With Sentry, control goes down into silicon
The real originality lies in Sentry.
This reference architecture uses an NVIDIA BlueField-4 DPU as an independent watchdog. Sentry continuously monitors the agent’s activity from a layer separate from its execution environment. If it attempts to go outside defined limits, Sentry can quarantine it in a few milliseconds.
The difference with a traditional software control lies precisely in this independence.
Sentry operates in a trusted, isolated domain, separate from the agent and invisible to it. NVIDIA describes it as an out-of-band mechanism capable of inspecting requests and responses, verifying the agent’s identity, producing telemetry and applying granular Zero Trust-style access policies.
The manufacturer speaks of “in-silicon security enforcement.” Some rules are thus no longer applied solely by the application or the runtime. They can be enforced by hardware infrastructure located underneath.
Zero Trust applied to agents
The approach recalls Zero Trust. A component should not be considered trustworthy simply because it belongs to the system.
The issue takes on a particular dimension with autonomous agents. An agent has an identity, rights and an access perimeter. We must therefore determine what it can do, on which data, with which tools and within what limits.
The challenge is not limited to model security. It also involves building an infrastructure capable of containing its autonomy.
Controls must therefore be able to operate on identity, runtime, network, data and infrastructure; rather than remaining confined to the prompt or the model.
A coalition to secure the whole stack
NVIDIA claims involvement from more than 100 organizations* in its initiative. However, one should not read this as a uniform list of customers or adopters. The levels of engagement vary.
Anthropic works with NVIDIA to add controls around its Claude Managed Agents. SAP integrates OpenShell into Joule Studio Runtime. Salesforce has integrated it into Slack to enable teams to track agent activity, audit it and manage certain permission requests.
Scale AI uses the reference architecture in its agent infrastructure. Figure, Gecko Robotics and Skild AI are working separately on integrating controls into autonomous systems operating in the physical world.
Other players are involved at other levels. Citi and JPMorganChase collaborate with NVIDIA on open-source agent security technologies. Operators across infrastructure and software also integrate OpenShell and the related technologies into their environments.
The message sent to the ecosystem is that agent security should no longer fall under the sole responsibility of the model vendor. It must be able to operate across the entire chain.
Hardware becomes a new control point
Shifting the control to the infrastructure extends the role NVIDIA seeks for its networking and computing components in AI architectures.
With Open Agent Safety Platform, the DPU becomes an independent observer capable of intervening directly in an agent’s execution. Security thus no longer rests solely on the model or the application. It can also rely on a hardware control point located outside the agent itself.
The approach also carries a paradox.
NVIDIA opens OpenShell and says it will make it compatible with Arm and Intel platforms. At the same time, the Sentry architecture relies on its BlueField-4 DPU.
The openness of the runtime can foster broad adoption of the software layer, while NVIDIA retains with the DPU a level of hardware control directly tied to its architecture.
The software becomes open but the hardware control point remains linked to NVIDIA’s architecture.
*notamment Anthropic, Cisco, CrowdStrike, Dell Technologies, HPE, Microsoft, Palantir, Palo Alto Networks, Red Hat, Salesforce, SAP, Scale AI, ServiceNow et Figure.
