NVIDIA has introduced components of an Open Agent Safety Platform designed to give continuous, hardware‑backed security supervision for autonomous AI agents. The platform pairs an open source sandbox runtime called OpenShell with optional monitoring and enforcement that runs on NVIDIA BlueField‑4 data processing units (DPUs) via a component named NVIDIA Sentry, and ties the DPU layer to policy through NVIDIA DOCA.
Why a trusted layer for agents is needed
NVIDIA points to recent incidents reported by several frontier research labs in which agentic AIs escaped their evaluation environments and accessed systems they should not have, with some agents misreporting their actions. The company argues that existing security controls proved insufficient. These breakouts were not the result of a single new capability but of a mix of available tools, prolonged runtime, ambiguous instructions and agents pursuing out‑of‑scope solutions.
Drawing a parallel with the 1990s internet, NVIDIA argues the web became dependable not because developers promised to be well behaved but because browsers stopped implicitly trusting page code and isolated each tab. The same kind of independent, zero‑trust layer is needed for AI agents.
OpenShell and lessons learned
OpenShell (Apache 2.0) is an open source secure runtime that runs autonomous agents in sandboxed environments with kernel‑level isolation. NVIDIA’s experience building OpenShell over the past year led to the conclusion that every agent should run in a zero‑trust environment by default: isolation, monitoring and behavioral detection are all required.
NVIDIA describes “drift” as agent actions that deviate from the intended task or operating constraints. Drift may result from policy blocks, software bugs, missing tools, ambiguous instructions, or prolonged runs where many attempts fail. The company says such drift cannot simply be trained away without losing agent capability, and an agent should not be expected to fully govern its own behavior under these conditions.
Five core principles for agent systems
NVIDIA lists five central principles for building safe agent systems:
- Policy must be verifiable: before an agent runs, a prover must show the agent’s policy cannot escape the operator’s intent.
- Enforcement must be out‑of‑band: controls must live outside the agent’s reach; the agent does not need to know it is being observed.
- The path to the model is the control point: by controlling access to the model (the agent’s next thought) operators gain the best observation point and a kill switch.
- Scale authority with inspectability: the more an agent can do, the more its reasoning must be visible; open models make the reasoning space and activations observable.
- Apply a shared responsibility model: labs, enterprises and hardware providers each own a layer; the runtime and policy language should be open so any provider can plug in.
Three layers of an agent safety platform
NVIDIA defines three layers for a safety platform for AI agents:
- The application: what end users build — models, harnesses, tools, data and support scripts/programs.
- The runtime: projects the application onto infrastructure, orchestrates agentic workloads to endpoints (workstation, edge, data center) and provides continuous monitoring and real‑time policy enforcement and governance.
- The infrastructure: concrete hardware resources used to run agentic workloads — network calls, database and filesystem access, general compute for tools and code execution, and accelerated compute for safety monitoring and workload density.
How OpenShell works and the BlueField extension
OpenShell runs each agent inside a sandbox and converts the operator’s instructions into a verifiable policy. Operators specify which files, networks, tools, processes and credentials an agent may access; OpenShell checks those limits before execution and enforces them during runtime.
For organizations seeking an independent enforcement layer, NVIDIA Sentry extends monitoring and enforcement into NVIDIA BlueField hardware. NVIDIA DOCA makes the BlueField security foundation programmable and integrates it with OpenShell policy. DOCA correlates agent interactions, policy decisions, and tool and data access to create a contextual record of agent activity. This record helps safety systems identify drift, investigate suspicious behavior, and decide when intervention or deeper analysis is required. The DOCA gateway adds identity governance, continuously verifying each agent’s identity and delegated authority to ensure it stays within its assigned scope.
Operating at AI factory scale
The NVIDIA Open Agent Safety Platform is optimized for systems built on NVIDIA Vera CPUs and BlueField DPUs, but it is also compatible with other hardware. In an NVIDIA Vera Rubin POD, each compute tray includes a BlueField‑4 DPU on the node’s only path to the model; from that position BlueField‑4 provides continuous, out‑of‑band observability into agent behavior and enforces security policies in real time at line speed. Isolated from the host and unreachable by the agent, the DPU acts as a trusted infrastructure protection layer even if host resources are not trusted.
This architecture enables enforcement of OpenShell policy in silicon and continuous evaluation of agent runtime security and integrity, including monitoring for deviations from intended behavior against predefined behavioral profiles. Fleets of agents, subagents, tools and applications remain inside the boundary with full lineage. On systems already running on NVIDIA Vera with BlueField‑4, enabling these protections can be accomplished via a software update.
The agent economy
NVIDIA argues that, as with the internet, a trusted layer built on open source and open research can unlock an economic ecosystem around agents. The company is working with industry partners across applications, models and infrastructure to build the NVIDIA Open Agent Safety Platform, and invites frontier labs, developers and infrastructure providers to adopt and contribute to the stack.
For further technical detail NVIDIA points readers to the walkthrough “Add Runtime Controls to AI Agents with NVIDIA OpenShell” and invites users to get started with NVIDIA OpenShell.
