NVIDIA launches Open Agent Safety Platform with hardware-level monitoring and runtime controls for autonomous AI agents
NVIDIA has launched the Open Agent Safety Platform, an open software platform and reference system design intended to enforce security boundaries around autonomous AI agents from testing through production deployment.
The platform combines NVIDIA OpenShell secure runtime software with NVIDIA Sentry, an out-of-band watchdog running on BlueField-4 DPUs. The two layers are designed to keep enforcement outside the agent itself, so an agent cannot simply override application-level instructions to escape its permitted operating boundary.
OpenShell traces agent actions and applies runtime policies, while Sentry independently monitors activity in silicon and can quarantine an agent in milliseconds when it attempts to operate outside its authorized boundary.
··········
NVIDIA OPEN AGENT SAFETY PLATFORM AT A GLANCE
........
Component | Role |
NVIDIA OpenShell | Open-source secure runtime boundary |
NVIDIA Sentry | Out-of-band hardware watchdog |
Primary hardware | BlueField-4 DPU for Sentry |
CPU integration | NVIDIA Vera |
Policy model | Runtime and zero-trust enforcement |
Monitoring | Continuous agent activity monitoring |
Response | Quarantine and stop agents outside boundaries |
Telemetry | Attested telemetry and identity verification |
Protected resources | Data, tools, APIs and services |
Third-party compute | OpenShell extensible to Arm and Intel platforms |
Availability | OpenShell and platform skills available to developers |
........
The architecture addresses a specific failure mode of autonomous agents: application-level safeguards can become insufficient when the agent itself is the software attempting to complete a task and discovers a path around those safeguards.
··········
OPENSHELL CREATES AN ENFORCEABLE RUNTIME BOUNDARY OUTSIDE THE MODEL
OpenShell is the software enforcement layer of the platform.
It creates a secure runtime boundary around an agent, traces the actions performed during execution and applies policies governing what the agent can access or do.
NVIDIA positions this boundary outside the model and agent harness. That separation means model instructions are not the only mechanism responsible for preventing unauthorized behavior.
On NVIDIA infrastructure, OpenShell is optimized for Vera CPUs. Because it is open-source software, NVIDIA also says it can be extended to third-party compute platforms including Arm and Intel systems.
··········
SENTRY MOVES AGENT MONITORING INTO AN ISOLATED HARDWARE TRUST DOMAIN
Sentry adds a second control layer that does not depend on the agent's own runtime environment.
The reference design runs Sentry on NVIDIA BlueField-4 DPUs as an out-of-band watchdog that continuously observes agent behavior.
The DPU operates as an isolated infrastructure layer, allowing monitoring and enforcement to continue independently from the CPU or software environment in which the agent executes.
If an agent attempts to move outside its defined software boundary, NVIDIA says Sentry can quarantine and stop it within milliseconds.
This changes the security model from asking the agent to respect a policy to placing an external enforcement system between the agent and the infrastructure it wants to use.
··········
DOCA PROVIDES THE PROGRAMMABLE SECURITY LAYER BEHIND SENTRY
Sentry is built on NVIDIA DOCA software, the programming framework for BlueField DPUs.
DOCA allows the system to inspect agent requests and responses, verify agent identity, produce attested telemetry and enforce granular access policies.
Those policies can cover data, tools, APIs and services, allowing permissions to be evaluated at the infrastructure layer rather than relying exclusively on the agent's own decision process.
The resulting architecture resembles zero-trust access control applied continuously to autonomous software: identity and permission are checked as the agent interacts with external resources.
··········
THE PLATFORM SEPARATES MODEL SAFETY FROM SYSTEM SAFETY
A model can be aligned to refuse dangerous instructions while the system surrounding it still exposes excessive permissions, credentials, tools or network access.
NVIDIA's design treats these as separate problems.
Model behavior remains one layer, while OpenShell constrains execution and Sentry provides independent hardware monitoring and enforcement.
This is particularly relevant for long-running agents because their behavior emerges across many sequential model calls, retrieved documents, tool responses and external state changes. A safe response at one step does not guarantee that the complete workflow remains inside policy.
··········
CLAUDE MANAGED AGENTS CAN ADD NVIDIA'S INFRASTRUCTURE CONTROLS
Anthropic and NVIDIA are collaborating on additional security layers for enterprise agents.
Claude Managed Agents separate the agent loop from the sandboxes where work is executed. NVIDIA says integrations with OpenShell and BlueField can then impose additional controls over the agent's access through those sandboxes.
The structure creates multiple independent boundaries: the model and agent layer, the execution sandbox, the OpenShell runtime policy and the BlueField hardware enforcement layer.
··········
SPACEXAI IS USING THE PLATFORM WITH CURSOR AGENTS AND GROK MODELS
NVIDIA says SpaceXAI is using the Open Agent Safety Platform for Cursor coding agents and Grok models.
The use case illustrates why external enforcement becomes relevant for coding agents. An agent capable of reading repositories, modifying files, running commands and accessing services has a materially larger attack and error surface than a conventional chatbot.
Restricting permissions outside the model reduces the consequences of a successful prompt injection, unexpected tool choice or agent policy failure.
··········
SLACK CAN PROVIDE HUMAN APPROVAL FOR ADDITIONAL AGENT PERMISSIONS
Salesforce and NVIDIA have integrated OpenShell with Slack.
Teams can view agent activity and audit events from Slack and approve or reject requests when an agent needs additional permissions.
This introduces a human authorization point without requiring every routine action to be manually approved.
The pattern is useful for agents operating under least privilege: the agent receives a narrow default permission set and escalates only when a task requires access beyond that boundary.
··········
THE SAFETY LAYER EXTENDS BEYOND SOFTWARE AGENTS INTO ROBOTICS
NVIDIA is designing the platform to cover software, compute infrastructure and physical AI systems.
Figure, Gecko Robotics and Skild AI are among the robotics companies building with OpenShell.
The stakes change when an agent can trigger physical actions rather than only modify digital information. Runtime boundaries can govern which systems the agent can reach, while hardware-level monitoring provides an independent layer for detecting attempts to exceed those permissions.
··········
MORE THAN 100 ORGANIZATIONS ARE WORKING WITH THE PLATFORM TECHNOLOGIES
NVIDIA says more than 100 organizations are working with technologies from the Open Agent Safety Platform.
The ecosystem spans model developers, cybersecurity companies, enterprise software vendors, banks, infrastructure providers, consultancies and robotics companies.
Participants named by NVIDIA include Anthropic, Microsoft, Hugging Face, Perplexity, Palantir, Salesforce, SAP, ServiceNow, CrowdStrike, Cisco, Red Hat, Scale AI, Citi and JPMorganChase.
The platform also contributes to the Open Secure AI Alliance, an initiative governed by the Linux Foundation and initiated by NVIDIA with more than 120 organizations.
··········
HARDWARE ENFORCEMENT DOES NOT ELIMINATE AGENT RISK
The platform can enforce boundaries only when those boundaries and policies are correctly designed.
An agent operating inside an overly broad permission set can still perform harmful or unintended actions without technically violating the configured boundary.
Security therefore depends on least-privilege policy design, credential isolation, sandbox configuration, auditability and appropriate human approval in addition to runtime and hardware enforcement.
Sentry also does not replace model-level defenses against prompt injection or malicious content. Instead, it reduces the consequences when those defenses fail by limiting what the compromised agent can reach and by providing an independent enforcement mechanism.
··········
NVIDIA IS BUILDING AN EXTERNAL CONTROL PLANE FOR AUTONOMOUS AGENTS
The Open Agent Safety Platform reflects a broader change in AI security architecture.
As agents gain persistent memory, shell access, APIs, enterprise credentials and physical-world capabilities, safety cannot depend entirely on instructions embedded inside the same model that is performing the task.
OpenShell supplies the runtime boundary. Sentry supplies the independent hardware watchdog. BlueField-4 supplies the isolated enforcement domain. DOCA provides programmable inspection, identity and access controls.
Together, these components move part of agent governance outside the model and into infrastructure that the agent is not supposed to control.
For increasingly autonomous systems, that separation between the intelligence performing an action and the infrastructure authorizing it may become one of the defining security layers of production AI.
··········
FOLLOW US FOR MORE.
DATA STUDIOS
datastudios.org
