NVIDIA unveiled the Open Agent Safety Platform on September 28, combining open software and a reference system design intended to impose boundaries on artificial-intelligence agents from layers outside the model itself. The proposal pairs OpenShell, a runtime that controls agent actions, with Sentry, a separate watchdog designed to observe and stop activity from a BlueField-4 data processing unit.

The announcement is material because it moves part of agent security away from instructions and permissions inside an application and into infrastructure controls. An agent can receive rules through its prompt or orchestrator, but those rules still depend on the environment executing its decisions. NVIDIA is proposing a second boundary: policies enforced where the agent reaches data, tools, APIs, and physical systems.

### OpenShell: a runtime boundary

OpenShell is the open-source component. NVIDIA says it creates a secure boundary around an agent, traces its actions, and enforces policies while it works. The company says the software is now broadly available and, although optimized for its Vera CPUs, can be extended to third-party platforms including Arm and Intel. SecurityWeek reported that the available release is OpenShell 0.1.0 and that it supports tools including Codex, Claude Code, Pi, and Hermes.

The concept did not appear in full this week. NVIDIA introduced OpenShell in March; the current launch places it inside a broader architecture. That distinction matters: not every announced control is an equally new or equally deployed product. The platform joins an existing runtime with an additional design for independent monitoring.

### Sentry: supervision outside the host

Sentry is the more novel part of the design. It runs on BlueField-4 DPUs, separately from the host system where the agent operates. NVIDIA says that placement allows Sentry to keep observing activity and enforcing policy even if the host is compromised. The company also claims Sentry can quarantine an agent within milliseconds when it attempts to move beyond its assigned boundaries.

The system uses NVIDIA DOCA software to inspect requests and responses, provide attested telemetry, verify agent identity, and enforce granular zero-trust access to data, tools, APIs, and services. In practical terms, the platform treats an agent as a privileged identity whose permissions must be bounded, rather than as an application that can be governed only through instructions.

NVIDIA introduced the project with an ecosystem of more than one hundred organizations. CrowdStrike confirmed its collaboration and described how runtime and infrastructure signals could be combined with broader endpoint, identity, and cloud context. Anthropic also worked with NVIDIA on controls around Claude Managed Agents. These relationships show support and technical integration; they do not establish that every organization in NVIDIA’s official logo wall has deployed every component or reached the same level of adoption.

### What remains unproven

The announcement does not provide an independent evaluation measuring how many attacks or failures the architecture blocks, its overhead across varied workloads, or its false-positive rate. The milliseconds-level quarantine claim comes from NVIDIA. OpenShell provides an open software path, while Sentry’s out-of-band protection depends on the BlueField-4 design and should not be confused with universal availability on any server.

The central takeaway is architectural: the industry is acknowledging that an agent with access to credentials, code, and systems cannot be its own final supervisor. Separating execution, observation, and the authority to stop actions reduces dependence on safeguards inside the agent stack. Deployment evidence and independent testing will still be needed to determine whether that separation delivers the coverage and reliability promised by the launch.