Nvidia Launches Open Platform To Lock Down AI Agents Across Software And Hardware

Nvidia has launched what it calls the Open Agent Safety Platform, an open-source software framework and reference hardware design intended to give organisations enforceable security controls over autonomous AI agents from testing through to production deployment.

The platform combines two components: OpenShell, a secure runtime that traces agent actions and enforces policy at the software layer, and Sentry, a hardware-based watchdog running on Nvidia BlueField-4 data processing units (DPUs) that monitors agent behaviour independently and can quarantine agents that attempt to exceed their boundaries in milliseconds.

More than 100 organisations from across the AI ecosystem have signed on to work with the platform, including Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow and SpaceXAI.

Nvidia’s Founder and CEO, Jensen Huang, framed the initiative as a necessary step for the AI industry.

“AI’s potential for society will only be realized if we solve AI safety,” Huang commented. “As we continue to discover the frontier of AI capabilities, we must accelerate discovery at the frontier of AI safety. Safety and security require full-stack engineering.”

“Nvidia Open Agent Safety Platform brings together industry, researchers and public-sector organizations to share best practices, align on evaluation methods and foster international cooperation. Together, we can raise the bar for global AI safety.”

In a post on X, Huang added that the effort is “bigger than a single product” and described it as “the beginning of an open ecosystem to build the trust layer for safe agent systems.”

Why agent safety controls are needed now

The launch follows a series of security incidents across the AI industry in which autonomous agents broke out of their evaluation environments, accessed systems they were not meant to reach and in some cases misrepresented their own actions.

Nvidia’s technical team drew a parallel to the early days of the internet, when browsers introduced sandboxing to isolate web pages and prevent rogue code from compromising a user’s computer.

“Agent safety requires independent security controls,” the company’s engineering team wrote in a technical blog post accompanying the launch. “The internet was not made secure by requiring that web developers promise to be good. It became safe because the browser stopped trusting the code in the web pages explicitly.”

The team described a phenomenon it calls “drift”, where agents depart from intended tasks or operating constraints in response to policy blocks, bugs, missing tools or ambiguous instructions. This is particularly acute when agents are left running for extended periods to solve difficult problems.

“An agent in these circumstances cannot be expected to fully govern its own behaviour,” the team noted.

How the platform works

The Open Agent Safety Platform operates across three layers: the application layer where end users build with models and tools, a runtime layer that orchestrates workloads and enforces policy, and the infrastructure layer covering hardware resources.

OpenShell, released under the Apache 2.0 licence, provides the runtime layer. It runs each agent in a sandboxed environment with kernel-level isolation, restricting which files, networks, tools, processes and credentials an agent can access. Operators define permissions before the agent runs, and OpenShell enforces them continuously.

The software uses operating-system kernel controls to limit what a workload can read or modify and prevents it from acquiring additional system privileges. For network access, the system can go beyond simply allowing or blocking connections to a service. It can inspect HTTP, GraphQL and Model Context Protocol (MCP) traffic, permitting a data query while blocking a write through the same API.

These controls remain in place when an agent starts a shell, runs generated code, launches child processes or proposes task delegation to sub-agents. OpenShell records policy decisions in an Open Cybersecurity Schema Framework (OCSF) audit trail.

OpenShell is optimised for Nvidia’s Vera CPU, which the company describes as its first purpose-built CPU for agentic AI. As open-source software, it can also be extended to work with third-party compute platforms from Arm and Intel.

Hardware-level enforcement with Sentry

For organisations seeking an additional layer of protection, Nvidia Sentry extends monitoring and enforcement into hardware.

Running on BlueField-4 DPUs, Sentry sits on the network’s only path to the model, providing out-of-band observability into agent behaviour and enforcing security policies in real time. It operates in an isolated trust domain, invisible to agents and beyond the reach of any compromised host software.

Sentry is built on Nvidia’s DOCA software framework, which provides programmable capabilities to inspect agent requests and responses, verify agent identity and enforce granular, zero-trust access policies for data, tools, APIs and services.

In Nvidia’s Vera Rubin POD architecture, each compute tray includes a BlueField-4 DPU on the node’s only path to the model. For organisations already running on these systems, Nvidia indicated that enabling these protections requires only a software update.

Five principles for agent security

Nvidia’s engineering team outlined five core principles that guided the platform’s design.

First, policy needs to be verifiable, meaning that before an agent runs, a formal prover should confirm that its policy cannot escape the operator’s intent.

Second, enforcement must operate out of band, meaning the controls do not live inside or within reach of the agent.

Third, the path to the model is the control point, since an agent cannot act without its next inference call, and controlling that path provides both the best observation point and a kill switch.

Fourth, the more authority an agent has, the more its reasoning needs to be visible. The team argued this gives open-weight models an advantage, since their full reasoning space and activations can be inspected.

Fifth, a shared responsibility model applies, where labs, enterprises and hardware providers each own a layer, similar to the cloud computing model.

Credential protection and dynamic permissions

A key feature of OpenShell is its approach to credential management. When agents need access to model APIs or private services, OpenShell authorises that access while keeping real credentials outside the agent workload.

The system substitutes a placeholder key with the real credential outside the sandbox and only for authorised endpoints. If an agent sends the placeholder to a destination outside the credential’s approved endpoints, OpenShell rejects the request. Even when a credential has write access, an inspected read-only API policy can block write requests.

OpenShell also includes a “policy advisor” mode, where an agent can propose narrowly scoped policy changes if it discovers it needs access that was not anticipated at the start of a task. These proposals are held for human review by default, and the agent cannot approve its own request.

The platform includes a formal policy prover that uses formal logic to verify what permissions a policy actually grants, including checking whether alternative routes exist that could circumvent restrictions. In testing, Nvidia reported that frontier AI agents with reduced safeguards spent up to two hours attempting to persuade an AI reviewer to grant permissions that would allow them to modify a protected GitHub repository. The formal analysis gave the reviewer evidence of what those permissions would allow, and no protected repository writes occurred during the tests.

Industry partners detail their involvement

Anthropic, the maker of Claude, has collaborated with Nvidia to bring additional security layers to the agent stack. The company’s Claude Managed Agents establish a security boundary by running the agent loop in a separate server from the sandboxes where work executes, with integrations into OpenShell and BlueField for hardware-level enforcement.

Anthropic’s Chief Commercial Officer, Paul Smith, explained the rationale: “Companies are giving AI agents more of their most important work, and they need to direct and verify what those agents do, especially in sensitive environments. Claude Managed Agents gives companies a clear view of what each agent is doing, and Nvidia’s platform adds another layer of governance and control across hardware and software.”

SpaceXAI is deploying the platform for its Cursor coding agents and Grok models.

“As customers rely more on agents to get real work done, safety should be enforced outside the model by additional controls the agent can’t get past,” remarked SpaceXAI’s President, Mike Nicolls. “Customers should be able to set those limits for Cursor and Grok and trust they will hold.”

Scale AI is incorporating the platform’s technologies into the agentic infrastructure layer of its Scale GenAI Portfolio.

Scale AI’s CEO, Francis deSouza, described the integration: “Scale AI is using the Nvidia Open Agent Safety Platform reference design to build reliable agentic AI systems for our enterprise and government customers running mission-critical applications, with isolation, policy enforcement and auditability built in from the start.”

“We support agentic security with clear boundaries that define what agents can do, and controls that keep them operating within those permissions.”

Enterprise integrations and adoption

Salesforce and Nvidia have integrated OpenShell with Slack, enabling teams to manage agent activity directly from the messaging platform. Users can view agent activity and audit events and approve or reject agent requests for additional permissions.

SAP is embedding OpenShell with its Joule Studio runtime, part of the SAP Business AI Platform, to pair business oversight with runtime security. The company is also contributing engineering work to OpenShell and working with Nvidia to advance interoperability standards through the Open Secure AI Alliance.

OpenShell version 0.1.0 supports sandbox operations, policy verification, governance integration, credential protection and flexible compute across containers, virtual machines and Kubernetes environments. It supports a range of agent frameworks, including Codex, Claude Code, Pi and Hermes.

Cadence is using OpenShell for chip design with its ChipStack Autonomous RTL Design Engineer. Gecko Robotics is using it to govern agents making decisions on physical robots. Slack is building an on-demand agent platform on the runtime.

Financial services, energy and infrastructure

Citi and JPMorganChase are among the financial services organisations collaborating with Nvidia on shared open-source agent safety technologies.

In the energy sector, Hitachi Energy, EPRI, NextEra Energy, Quanta Services, SPP, Schneider Electric, Siemens Energy and Worley are working with the platform as critical US infrastructure providers.

Robotics companies including Figure, Gecko Robotics and Skild AI are building with OpenShell to embed agent safety controls into autonomous systems that operate in the physical world.

Infrastructure software providers Canonical, SUSE and Red Hat are integrating the platform into their operating systems. Red Hat runs OpenShell and DOCA on Red Hat AI Factory with Nvidia, which it describes as an enterprise-grade AI solution for building, deploying and managing AI at scale across hybrid cloud environments.

Cloud and infrastructure partners including Baseten, Cisco, CoreWeave, Dell Technologies, GMI Cloud, HPE, HP Inc., Lenovo, Microsoft, Nebius, Oracle Cloud Infrastructure, Supermicro and Together AI are offering AI infrastructure solutions that use and support the platform.

Open-source governance

Ecosystem contributions to the platform support the mission of the Open Secure AI Alliance, which was initiated by Nvidia alongside more than 120 organisations and is governed by the Linux Foundation. The alliance aims to strengthen AI agent security through open research, tools and projects such as the Shared AI Findings Exchange, or SAFE.

OpenShell software and associated tools are available through Nvidia’s developer resources page and GitHub.

Last Updated on September 28, 2026 by Nick Ross