How Does NVIDIA's Open Agent Safety Platform Secure AI Agents?

NVIDIA's September 28 announcement addresses a problem for companies deploying AI agents: instructions inside an agent are not the same as enforceable limits on what it can access. The new Open Agent Safety Platform combines a software runtime with a hardware-monitoring reference design. That distinction matters because an agent may use tools, data and external services while pursuing a task. NVIDIA describes a way to govern those actions outside the model itself, rather than asking the model to police its own behavior.

OpenShell Sets a Boundary Around Agent Actions

The platform overview places NVIDIA OpenShell at the software layer. Its runtime is intended to trace actions and enforce policies as agents operate, while the developer documentation explains why a separate execution boundary is useful. Policies outside the agent's reasoning process can restrict tool use even when a model produces an unexpected instruction. NVIDIA says OpenShell is broadly available and open source; it also says the software can be extended beyond its own compute platforms.

That is a different layer of control from writing careful prompts or approving outputs after the fact. Teams still need to decide which tools an agent can invoke and what data each task requires. Our guide to building AI agents explains the workflow context, while the platform's value here lies in enforcing the resulting permissions at runtime.

Sentry Adds an Independent Hardware Watchdog

NVIDIA's Sentry technical description presents a reference design for monitoring agents outside their execution environment. It runs on BlueField-4 data processing units and, according to NVIDIA, can quarantine an agent that crosses a defined boundary in milliseconds. Those are vendor-reported capabilities, not independent proof that every attempted escape will be detected.

Sentry uses DOCA software for programmable inspection and policy enforcement. NVIDIA also positions the Vera CPU as a host for OpenShell's runtime controls. The separation between software enforcement and an out-of-band monitor is the core architectural claim: an agent should not be able to change the watchdog simply by changing its own instructions.

Partners Will Test the Design in Real Workflows

The announcement names Anthropic, Salesforce and other organizations working with the platform. NVIDIA says Anthropic's managed-agent setup can pair its existing sandbox separation with OpenShell and BlueField controls. Salesforce has integrated OpenShell activity into Slack so teams can see audit events and approve or reject requests for more permissions. These examples describe integrations; they do not establish a common rollout date or measured security outcome across all partners.

The OpenShell source repository gives technical teams a starting point for examining implementation. Integration demands matter: our coverage of agent plugin interoperability shows why connections across tools complicate governance, while NVIDIA's physical-AI work illustrates a separate setting in which software decisions can affect real systems.

Security Claims Need Deployment Evidence

For enterprise buyers, the unanswered questions are operational. Which actions are logged, who approves exceptions, and how does an organization test whether a policy holds when an agent encounters an unexpected tool response? NVIDIA says OpenShell and related software are available, but the announcement calls Sentry a reference system design and cautions that some described features remain subject to availability. A procurement decision should distinguish documented software from a future hardware deployment.

Open development may help scrutiny, but it does not substitute for testing. NVIDIA links the effort to the Open Secure AI Alliance. Readers can compare that collaboration with our reporting on open AI ecosystems and AI provenance controls; neither is a substitute for assessing this platform's actual threat model.

What This Means for Practitioners

Start with one agent and a narrow permission set. Define prohibited tools and data paths, then test whether OpenShell enforces those boundaries while recording useful audit evidence. If Sentry-based hardware is under consideration, ask for a deployment plan and independent results against the failures your organization cares about. NVIDIA has presented an architecture for external controls, not a guarantee that agent incidents disappear.