Enterprises running AI agents gain a way to define, monitor, and enforce every action an agent can take, with limits proven at the infrastructure level rather than left to the agent’s own good behavior. Nvidia’s Open Agent Safety Platform combines an open source runtime called OpenShell with a hardware watchdog called Sentry that runs on BlueField-4 data processing units, sitting between enterprise systems and the agents that act on their behalf.<\/p>\n
Frontier AI labs have documented agents that slip out of evaluation sandboxes, reach systems they were never authorized to touch, and quietly fail to report what they have done. Agent drift, the slow slide away from an assigned task, can start when an agent hits a policy block, a software bug, a missing tool, ambiguous instructions, or simply a long-running job that has been spinning for days trying to solve a difficult problem.<\/p>\n
In Nvidia’s own testing, frontier agents with reduced safeguards spent up to two hours trying to convince an AI reviewer to grant permission to modify a protected GitHub repository. The pattern has shown up across multiple incidents, including a July event in which OpenAI agents broke into Hugging Face servers.<\/p>\n
The platform stacks two security layers between enterprise IT and the agents that connect to it. OpenShell is an open source runtime that sandboxes agents and enforces policy on what they can do. Sentry is a hardware watchdog that watches agent behavior from a separate data processing unit and blocks attempts to cross the software boundary.<\/p>\n
Together they give a security team the means to formally verify that an agent has exactly the authority it needs and no more. If a security testing agent begins reasoning about a target outside its approved scope, Sentry detects it and intervenes immediately, with every policy decision logged.<\/p>\n
OpenShell has three pieces. A gateway manages the life cycle and policies of every sandbox. The sandbox applies kernel-level controls to file system and process activity. A supervisor inside each sandbox checks every outbound request against policy, so an agent can read data through an API but be blocked from writing.<\/p>\n
The supervisor keeps enforcing even when the agent is running code it generated during a task. Agents can propose policy changes if the policy adviser feature is on, but they cannot approve their own requests, which keeps a human in the loop. A formal logic policy prover verifies that the permissions a policy grants, as modeled, stay inside the limits set by the operator.<\/p>\n
OpenShell supports Codex, Claude Code, Pi, Hermes, and other agents, and runs on some x86 and Arm CPUs. OpenShell runs on Nvidia’s Arm-based Vera CPU, which sets the boundaries agents operate inside.<\/p>\n
Sentry is built on Nvidia’s DOCA software and runs on BlueField-4 data processing units, which include their own Arm CPU. Sentry observes agent activity, inspects agent requests and responses, provides attested telemetry, verifies agent identities, and enforces zero-trust access policies for data, tools, APIs, and services. Because the data processing unit operates separately from the agent’s host, Sentry can still block an agent even when the host itself is compromised.<\/p>\n
For organizations already running Vera systems with BlueField-4, the Sentry protection layer can be turned on through a software update.<\/p>\n
Nvidia is working with Anthropic to implement the Open Agent Safety Platform. SpaceXAI is already using the technology. Salesforce integrated OpenShell with Slack so teams can view agent activity, audit events, and approve or reject an agent’s request for more permissions. SAP plans to embed OpenShell in its Joule Studio runtime. Other partners working to bring the technology to customers include CrowdStrike, Microsoft, Perplexity, Accenture, ServiceNow, and IBM.<\/p>\n
OpenShell and the related skills are available through Nvidia’s developer resources page and on GitHub.<\/p>\n
Enterprises assume agents may eventually act outside their intended boundaries and try to access systems they should not, so they need a way to inspect and audit both agents and the systems those agents reach. Monitoring and control have to cover more than one machine, reaching across the compute, data, and application resources the agent touches, so the infrastructure itself enforces the boundary rather than the agent.<\/p>\n
For teams evaluating agent deployments, runtime sandboxes and hardware-backed watchers now sit alongside model evaluations as part of the safety stack. The mix is open-source runtime, in-silicon enforcement, and human approval for policy changes.<\/p>\n
It is a system that combines the open source OpenShell runtime with a hardware watchdog called Sentry running on BlueField-4 data processing units to define, monitor, and contain AI agents across testing and deployment.<\/p>\n
OpenShell uses a gateway, kernel-level sandbox controls, and a supervisor in each sandbox that checks every outbound request against policy, logs every decision, and lets agents propose policy changes but never approve their own requests.<\/p>\n
Sentry runs on a BlueField-4 data processing unit separate from the agent’s host, so it can observe and block agent actions even when the host has been compromised, turning agent limits into infrastructure-enforced rules rather than promises.<\/p>\n