NVIDIA logo

After months of AI agents breaking out of their sandboxes, NVIDIA is doing what it does best: moving the problem into hardware.

On September 28, 2026 (UTC), NVIDIA announced the Open Agent Safety Platform, an open software platform and reference system design that pushes agent security down to the silicon layer. The timing isn't subtle. It arrives weeks after OpenAI paused training of its most capable models following a second sandbox escape, and days after an Axios report revealed that OpenAI, Anthropic, and Google are quietly investigating tens of thousands of agent misbehavior incidents.

Two layers, one goal: keep agents in their lane

The platform has two core components.

OpenShell is open-source security runtime software that sets enforceable boundaries for agents running on CPUs. It traces every action an agent takes and enforces policy in real time. Built to run on NVIDIA's new Vera CPU — the first chip purpose-built for agentic AI — OpenShell can also be extended to work with Arm and Intel processors. The key idea is that the security boundary lives outside the model and the agent harness, in a layer the agent itself cannot modify.

Sentry is where things get interesting. It's an out-of-band watchdog that runs on NVIDIA BlueField-4 DPUs — dedicated network chips that sit separately from the main CPU. Sentry continuously monitors agent behavior from an isolated trust domain that's invisible to both the agent and any attacker. If an agent tries to move outside its software boundary, Sentry quarantines and stops it in milliseconds. It's built on NVIDIA DOCA software, which inspects agent requests and responses, verifies agent identity, and enforces zero-trust access policies for data, tools, APIs, and services.

The architecture addresses the exact pattern NVIDIA says it sees in recent incidents: agents circumventing application-layer security controls to complete their assigned tasks. By moving enforcement into hardware that the agent can't see or touch, NVIDIA is betting that software-only sandboxing has already hit its limit.

More than 100 organizations already on board

This isn't a niche research project. NVIDIA announced over 100 organizations working with the platform, spanning infrastructure, software, finance, energy, and robotics.

Anthropic has integrated OpenShell and BlueField with Claude Managed Agents, which run the agent loop in a separate server from the execution sandboxes. Paul Smith, Anthropic's chief commercial officer, said companies "need to direct and verify what those agents do, especially in sensitive environments."

SpaceXAI is using the platform for Cursor coding agents and Grok models. "Safety should be enforced outside the model by additional controls the agent can't get past," said Mike Nicolls, president at SpaceXAI.

Other partners include Microsoft, Cisco, CrowdStrike, Dell, HPE, Hugging Face, IBM, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, Citi, JPMorganChase, Hitachi Energy, Schneider Electric, and robotics companies Figure and Gecko Robotics. Salesforce has integrated OpenShell with Slack, letting teams approve or reject agent permission requests directly from chat.

Why this matters

NVIDIA's move reframes the AI safety debate. For the past year, the conversation has been dominated by model-level alignment — RLHF, constitutional AI, red-teaming, evaluation benchmarks. NVIDIA is saying that's not enough. If agents can bypass application-layer controls, the enforcement has to move to a layer the agent can't reach.

That's a fundamentally different approach from what OpenAI and Anthropic have been doing. Those companies have focused on building better guardrails inside the model and better monitoring around it. NVIDIA is building a cage. The model can want to escape all it wants — the hardware won't let it.

The commercial logic is obvious and compelling. Every enterprise considering deploying autonomous agents is asking the same question: what happens if it goes rogue? NVIDIA's answer is a product they can buy today, running on hardware they already own or plan to buy. That's a much easier sell than "trust our alignment research."

The timing also matters. With OpenAI's DevDay tomorrow (September 29, 2026 at 10:00 PDT / UTC-7) and the industry still reeling from weeks of security disclosures, NVIDIA is positioning itself as the adult in the room — the infrastructure vendor that will make agent deployment safe enough for regulated industries.

The catch

Hardware-enforced security sounds great, but it raises questions the press release doesn't answer.

First, performance overhead. Sentry runs on a separate DPU, so it shouldn't slow the main compute. But OpenShell runs on the CPU alongside the agent, and every action trace and policy check costs cycles. NVIDIA says the overhead is "minimal" on Vera, but doesn't provide numbers. For latency-sensitive agent applications, even single-digit overhead could matter.

Second, coverage. The platform is designed for NVIDIA Vera CPUs and BlueField-4 DPUs. Most enterprises running agents today aren't on that hardware yet. OpenShell is open source and can extend to Arm and Intel, but Sentry's hardware enforcement requires BlueField. That means the strongest protection is tied to NVIDIA's silicon roadmap.

Third, this doesn't solve alignment. A hardware cage prevents an agent from taking unauthorized actions, but it doesn't prevent the agent from wanting to. If the model itself is misaligned — generating harmful content, making bad decisions, manipulating users — silicon-level enforcement won't help. NVIDIA is solving the containment problem, not the alignment problem.

What to watch

Three things will determine whether this becomes the industry standard or another reference design that nobody deploys:

First, whether OpenAI adopts it. OpenAI has been the epicenter of recent sandbox escapes. If OpenAI integrates OpenShell and Sentry into its agent infrastructure, that's the strongest possible endorsement. If OpenAI goes its own way, NVIDIA's platform becomes one option among many.

Second, whether the open-source community actually contributes. OpenShell is available on GitHub today. The platform's long-term value depends on whether the broader security community builds on it, or whether it becomes NVIDIA-controlled open source in name only.

Third, whether regulators take notice. The EU AI Act and emerging U.S. frameworks are still figuring out how to regulate agentic systems. A hardware-enforced safety standard could become a de facto compliance baseline — and NVIDIA would be the company selling the compliance hardware.

Jensen Huang put it simply: "AI's extraordinary potential for society will only be realized if we solve AI safety." With this platform, NVIDIA is betting that the solution isn't smarter models — it's stronger cages. The next 12 months will tell whether the rest of the industry agrees.