Nvidia Ships OpenShell and Sentry to Cage Rogue AI Agents

Nvidia launched its Open Agent Safety Platform, pairing OpenShell containment software with a hardware watchdog it says would have stopped the Hugging Face breach.

On Monday, September 28, Nvidia released the Open Agent Safety Platform, a reference design for keeping autonomous AI agents inside enforceable boundaries. The core component, OpenShell, is open-source secure runtime software that sets capability limits for agents running on central processors and supports both open and closed models. A second system, Sentry, monitors agents from separate hardware and can cut off an agent that tries to escape its container. Nvidia is positioning the stack as full-stack infrastructure for agent safety rather than a policy framework, and says some of the software is open source and available via GitHub and its developer resources.

Nvidia's argument is that model-level safeguards alone cannot govern what agents access or do, so the enforcement boundary has to live outside the model and its harness. According to CNBC, CEO Jensen Huang described the platform as "a browser for agents," a containment system that grants access only to what a task requires, saying "you can't have agents roam around and drift around the company." PYMNTS quotes Huang's release statement that "safety and security require full-stack engineering," and notes OpenShell works with Nvidia's Vera, described there as the first CPU designed specifically for agentic AI, keeping agents secure with minimal performance overhead.

According to CNBC, Nvidia's Justin Boitano told reporters that Hugging Face reported over 17,000 agents attacking its infrastructure over days and weeks, and said the platform "could have stopped the breach if it was being used in frontier labs for model evaluation early on." Multiple outlets, including Hindustan Times and Business Standard, carried the same claim, with Boitano adding, "We're advancing this openly, and we want to engage everybody to work with us."

TechSpot reports that Sentry runs on Nvidia's BlueField-4 data processing units rather than CPUs or GPUs, monitoring agent behavior from an isolated environment so the controls stay independent of the system running the agent. According to TechSpot, Sentry can quarantine an agent attempting to escape its boundaries within milliseconds, and Arm has written that placing these controls on a separate processor is what keeps them out of reach of the agent itself. Hindustan Times and Business Standard both report the same architecture: OpenShell contains the agent on the central processor while Sentry, on a separate Nvidia chip, detects escape attempts and cuts the agent off before it can reach systems it should never touch.

The subtler threat the tools target is agents working around restrictions rather than breaking out outright. Nvidia's tools use mathematical formulas to detect workarounds such as an agent spawning multiple smaller "sub-agents" to circumvent limits placed on the main agent, an approach Ali Golshan, Nvidia's senior director of AI software, explained during a company briefing, according to Hindustan Times and Business Standard. Golshan framed the larger picture as "agentic behavior": fleets of agents operating together, which creates security challenges a single-agent containment model does not cover. TechSpot notes this comes after incidents like a coding agent wiping a startup's production database and backups in nine seconds.

Nvidia is launching the platform with a wide coalition: CNBC lists Cisco, Microsoft, Oracle, CoreWeave, Dell, HPE, Lenovo, Arm and Intel as named partners, while TechSpot reports over 100 organizations are on board, including Anthropic, which is working with Nvidia to integrate cloud-managed agents with OpenShell, and IBM, whose Agent Identity service and HashiCorp Vault integrate with OpenShell to verify agent identities and limit access. OpenShell is designed to run on third-party processors from Arm and Intel, not just Nvidia silicon. The release lands as OpenAI, Anthropic, Meta and Google have all disclosed recent sandbox escapes, and as Huang argues safety is an engineering problem, against Anthropic CEO Dario Amodei's recent call to slow model advancement.