Nvidia’s Answer to Rogue Agents Is an Open-Source AI Security System
Nvidia’s announcement matters less as another AI-safety statement than as an attempt to define a practical control plane for agent execution. The key architectural idea is separation of duties: OpenShell constrains what an agent can do inside the host environment, while Sentry is positioned as an independent enforcement layer running on DPUs. For IT teams, that distinction is important. If policy enforcement depends only on the same host stack the agent is using, compromise paths and policy bypasses become much harder to reason about.
The real implementation question is whether organizations can turn this into consistent runtime governance across mixed estates. Many enterprises will not run a homogeneous Nvidia stack, and agent workflows increasingly span SaaS APIs, internal services, developer tools, and cloud workloads. That means OpenShell-style isolation is only one part of the control model; teams still need identity boundaries, network egress controls, secrets management, audit logging, and approval gates for high-impact actions. A sandbox can reduce blast radius, but it does not replace service-level authorization design.
There is also a platform trade-off. Tying continuous monitoring and quarantine to BlueField DPUs could improve isolation and observability for long-running agents, but it also introduces infrastructure dependencies, procurement implications, and integration work for security operations. Before adopting it broadly, architects should ask how policies are authored, how incidents are surfaced into existing SIEM/SOAR tooling, what evidence is captured for forensics, and whether controls remain portable if agent workloads move across clouds or onto non-Nvidia hardware.
Amidst ongoing reports of AI agents wreaking havoc on online infrastructure, chipmaker Nvidia is rallying tech companies to use its new open-source tool for AI security.
Over the last few months, frontier AI labs have disclosed multiple incidents in which AI agents have hacked into other companies or, in more recent examples, probed official US and Australian government websites. While Nvidia has already taken a leading role in rallying the AI industry around open source security, it’s now introducing one new software security platform and making an agentic AI sandbox more broadly available.
Don’t just keep up. Get ahead—with our biggest stories, handpicked for you each day.
OpenShell, one of the Nvidia’s recently launched security sandboxes for AI agents, is now entering general release for all users. OpenShell was first announced at Nvidia’s annual GTC Conference in March; it’s a framework for containing agents as they carry out tasks and isolating their activity in the operating system kernel, the foundational program that has access to virtually all parts of a computer system in order to coordinate hardware and software.
Nvidia’s launch materials indicate that it has AI safety and security collaborations with dozens of other tech companies, including Anthropic, Cisco, CoreWeave, CrowdStrike, Dell Technologies, Hugging Face, JPMorganChase, Mistral, Microsoft, and Palantir. Nvidia says SpaceXAI is using the Open Agent Safety Platform for its Cursor agents and Grok models. The company also says Anthropic and Nvidia are “building security into Claude Managed Agents.” Salesforce, Scale AI, and SAP are all confirmed to be integrating OpenShell to some degree. However, it is unclear whether OpenShell has been adopted by Nvidia’s full list of partners, or whether Nvidia is gesturing broadly.
One notable name is missing entirely from Nvidia’s list: OpenAI. Both companies indicated that OpenAI is a part of Nvidia’s OpenShell effort, though both declined to comment directly on why the AI lab was excluded from the announcement.
Security engineers and AI safety experts have considered the need to isolate and monitor agentic AI since well before the recent revelations of rogue agent hacking. Nvidia’s own OpenShell announcement in March noted that the framework would add “privacy and security controls to make self-evolving, autonomous AI agents, or claws, more trustworthy, scalable and accessible,” months before OpenAI disclosed that its AI agents had hacked the open source AI company Hugging Face. (Nvidia agreed to acquire Hugging Face earlier this month for $12.9 billion.)
The chip giant has also developed a new software platform called Sentry, an isolated security domain for chips that’s supposed to continuously monitor long-running AI agents. While Sentry is technically a software tool, it’s meant to be implemented on Bluefield, Nvidia’s line of programmable data processing units (DPUs). The idea is that in addition to the restrictions imposed by OpenShell, Sentry can act as a separate, independent mechanism that can “quarantine agents that attempt to move outside their boundaries.”
Sentry is another way for Nvidia customers and open-source users to actually implement security policies through OpenShell, says Justin Boitano, Nvidia’s vice president and general manager of enterprise computing. While traditional sandboxes are built for “application-level isolation,” people now want to run fleets of agents, which demands a “collective policy across all of those agents,” he says.
“Agents are very creative at finding ways to achieve the goals that they’re given,” Boitano says. “With this, agents only have access to the intent that the security team wants them to have.”
Boitano adds that Nvidia is working with both Arm and Intel to create a version of Sentry that works on the x86 chip architecture. “Once it runs on those instruction-set architectures, it can run on any architecture,” he says.
Enjoyed this article? Sign up for our newsletter to receive regular insights and stay connected.