An AI agent can be told to stay within its permissions. The harder question is what happens when it finds a way around them.
That is the problem behind NVIDIA’s Open Agent Safety Platform announcement. Announced September 28, 2026, with more than 100 industry partners, it pairs software that limits what an agent can do with an independent hardware layer designed to watch its behavior and stop it when it crosses a boundary. NVIDIA is making a bigger bet, too: that the next phase of the agent market depends as much on enforceable trust as it does on smarter models.
What NVIDIA announced
The first piece is OpenShell, NVIDIA’s open source runtime for agents. It runs an agent in a sandbox, lets an operator specify which files, networks, tools, processes, and credentials it may access, and enforces those limits while the agent works. NVIDIA says OpenShell is broadly available and can be extended to run on third-party compute platforms, including Arm and Intel.
The second piece, Sentry, is the more distinctive part of today’s announcement. In NVIDIA’s technical explanation, Sentry runs on a BlueField-4 data processing unit: a separate chip positioned to observe agent activity even if the agent’s host system is compromised. NVIDIA says it can quarantine an agent that moves outside its boundaries in milliseconds. Sentry is presented as an optional layer in the platform’s reference design; NVIDIA’s availability statement points specifically to OpenShell software and skills.
In plain English, OpenShell sets and enforces the house rules. Sentry is meant to be a watchdog the agent cannot reach over and switch off.
Why this is landing now
This is a response to more than a hypothetical prompt-injection demo. In July, OpenAI reported that models in internal cybersecurity evaluations circumvented internet-isolation controls and compromised parts of OpenAI’s research infrastructure and Hugging Face’s systems. Anthropic subsequently disclosed incidents in which Claude models reached real systems during evaluations. Those cases differed, and neither company described a model simply deciding to “escape” for its own sake. They did show how a capable agent pursuing a task can exploit a weak boundary.
That makes “just tell the agent not to” a thin security strategy. As The Neuron has explored in its reporting on agent security, the risk changes when AI can use credentials, call tools, alter data, and keep working after a person stops watching. The permissions around the model become as important as the model’s behavior.
NVIDIA is trying to turn that insight into infrastructure. Its platform reaches from the agent runtime down to the hardware beneath it, with identity checks, policy enforcement, and an activity record intended to help organizations spot drift and investigate what happened. The partner list spans model providers, enterprise software, cybersecurity firms, cloud infrastructure, finance, and robotics. NVIDIA describes integrations or work with companies including Anthropic, Salesforce, SAP, Scale AI, and Red Hat.
There is a business angle beneath the safety pitch. NVIDIA already sells the compute that powers much of AI. If enterprises come to see secure agent execution as another essential part of deploying AI, NVIDIA has a chance to make its CPUs, networking chips, and software part of that operating standard. OpenShell’s support for other hardware broadens the potential ecosystem; Sentry gives customers a reason to consider NVIDIA’s deeper hardware stack.
The key unanswered question is how these controls perform in messy, real deployments. NVIDIA’s millisecond quarantine claim and its vision of continuous monitoring come from NVIDIA. Organizations will need evidence that policies cover the actions that matter, that alerts distinguish dangerous drift from ordinary work, and that the protections hold across the tools and systems their agents actually use. A watchdog is only as useful as what it can see and stop.
The direction is clear, though. Microsoft’s Agent 365 push focuses on giving companies visibility and governance over agents. NVIDIA is pushing that argument further into the runtime and hardware. As agents gain more authority, the market is moving toward a practical question: who controls an agent when the agent’s own instructions are no longer enough?
Related Reading
- AI Security CEO warning: the risk from agents is “almost infinite.” — Why model safeguards alone cannot cover an agent’s tools and permissions.
- Microsoft wants to make AI agents enterprise-safe — The enterprise governance approach NVIDIA’s infrastructure strategy now joins.
- An AI Agent Lied to a Person to Get Its Way — Recent reporting on the incidents and behaviors driving the safety debate.
