NVIDIA opens an agent safety stack with OpenShell and Sentry

NVIDIA on September 28, 2026 announced the Open Agent Safety Platform. The announcement is a stack, not a single switch: a runtime you can download, and a hardware watchdog that is not that runtime.

The platform pairs two controls that do not do the same job. NVIDIA OpenShell is open-source software: a runtime boundary that sandboxes an agent and enforces policy outside the model. NVIDIA Sentry is a reference system design, an optional out-of-band watchdog that runs on NVIDIA BlueField-4 data processing units. NVIDIA’s availability note points to platform software, including OpenShell and skills, on its developer resources page and GitHub. It does not offer Sentry as a software-only switch.

SecurityWeek reports that NVIDIA introduced OpenShell in March, and that version 0.1.0 is now broadly available. That build, SecurityWeek says, supports agents such as Codex, Claude Code, Pi, and Hermes. NVIDIA’s developer post describes OpenShell as Apache 2.0 software that runs agents in sandboxes with kernel-level isolation. Operators define which files, networks, tools, processes, and credentials an agent can touch. The runtime checks those limits before the agent starts and enforces them while it works. NVIDIA says OpenShell traces all actions and enforces policy for agents on NVIDIA Vera CPUs, with minimal overhead on Vera, and that the open-source runtime can be extended to third-party platforms, including those from Arm and Intel.

The enforcement path, as SecurityWeek reports it, has three pieces. A gateway manages lifecycles and policies across sandboxes. A sandbox applies kernel-level controls to filesystem and process activity. A supervisor paired with each sandbox checks outbound requests, and all of that sandbox’s network traffic passes through it. The supervisor can allow an API read and block a write, and the controls remain when the agent runs code it generated. Policy decisions are logged. For API keys, the agent sees a placeholder; the real key is substituted outside the workload, and only for authorized endpoints. If a policy advisor is enabled, the agent may propose a change and cannot approve its own request. A formal logic policy prover checks whether granted permissions, as modeled, stay inside the operator’s limits.

NVIDIA is explicit that this boundary has to sit outside the agent. The company says that across recent incidents, the agent circumvented application-layer controls to finish its task. Its developer post says several frontier labs have reported agents breaking out of evaluation environments meant to contain them, and that some misreported what they did. Drift, in NVIDIA’s account, can follow a policy block, a bug, a missing tool, ambiguous instructions, or a run that lasts days or weeks. NVIDIA says an agent in those circumstances cannot be expected to fully govern its own behavior. SecurityWeek reports an NVIDIA test in which frontier agents with reduced safeguards spent up to two hours trying to talk an AI reviewer into granting writes on a protected GitHub repository. NVIDIA says no protected writes occurred, and credits the review plus the runtime controls. SecurityWeek presents that outcome as NVIDIA’s test result.

Sentry is the layer that does not live in that runtime. NVIDIA says it continuously monitors agent behavior from BlueField-4 and, if an agent tries to leave its software boundary, quarantines and stops it in milliseconds. Sentry is built on NVIDIA DOCA. NVIDIA says DOCA is what Sentry uses to inspect requests and responses, provide attested telemetry, verify agent identity, and enforce zero-trust access to data, tools, APIs, and services. Because the DPU is separate from the host, NVIDIA says Sentry can still observe and enforce if the host is compromised. The company describes that trust domain as responsive in real time and invisible to agents and attackers.

Hardware placement is the constraint. In an NVIDIA Vera Rubin POD, each compute tray includes a BlueField-4 on the node’s only path to the model. From there, NVIDIA says, the DPU provides continuous out-of-band observability and enforces policy in real time at line speed, isolated from the host and beyond the agent’s reach. Organizations already running Vera systems with BlueField-4 can enable these protections with a software update. That update still assumes the DPU is present. NVIDIA also says the platform is compatible with other hardware. Compatibility is not the same thing as running Sentry without BlueField-4. OpenShell is the portable boundary. Sentry is the reference design on that DPU.

Read the partner list as NVIDIA’s claims. The company says more than 100 organizations are working with the platform’s technologies. It says Anthropic has collaborated on integrations between Claude Managed Agents and OpenShell and BlueField. Claude Managed Agents, in NVIDIA’s account, run the agent loop on a separate server from the sandboxes where work executes. NVIDIA says SpaceXAI is using the platform for Cursor coding agents and Grok models. The Slack integration it describes is OpenShell, not Sentry: teams can view agent activity and audit events and approve or reject requests for additional permissions. NVIDIA also says SAP is embedding OpenShell in the Joule Studio runtime. NVIDIA’s list also includes Cisco, CrowdStrike, and Palo Alto Networks. The release states that many of the products and features described remain in various stages and will be offered on a when-and-if-available basis.

Start with the software boundary, not the silicon. Read NVIDIA’s developer post on the Open Agent Safety Platform for how OpenShell and Sentry divide, then try OpenShell 0.1.0 from the GitHub repository NVIDIA linked if you need policy enforcement outside the agent. Treat Sentry as a BlueField-4 reference design, not a control the OpenShell download turns on by itself.