NVIDIA Open Agent Safety Platform launches

NVIDIA today launched the Open Agent Safety Platform: an open software stack and reference system design meant to put hard boundaries around autonomous AI agents, from testing through production. The pitch is blunt. Recent agent security incidents, NVIDIA says, share one pattern — the agent worked around application-layer controls to finish the job it was given. The company's answer is to move enforcement below the app, into a runtime the agent does not control, and optionally into silicon the agent cannot see.

What launched: OpenShell plus Sentry

The platform has two named halves. NVIDIA OpenShell is an open-source secure runtime that sandboxes agents on CPUs, turns operator instructions into verifiable policies, and enforces which files, networks, tools, processes, and credentials an agent can touch. NVIDIA says the boundary sits outside the model and the agent harness, so the same rules apply to open and closed models. OpenShell 0.1.0 is broadly available on GitHub under Apache 2.0, with developer docs and a quickstart published alongside the announcement.

NVIDIA Sentry is the hardware watchdog in the reference design. It runs on NVIDIA BlueField-4 data processing units as an out-of-band monitor: if an agent tries to leave its software boundary, Sentry can quarantine it in milliseconds. Because Sentry lives on the DPU rather than in the host OS, NVIDIA argues it still works even if the agent runtime or host software is compromised. Sentry is built on NVIDIA DOCA for inspecting requests and responses, attested telemetry, agent identity, and zero-trust access to data, tools, APIs, and services.

How OpenShell actually gates an agent

The developer blog walks through the runtime shape. An OpenShell Gateway manages many sandboxes and their policies. Each sandbox gets a Supervisor that sits outside the agent workload and checks outbound requests against policy. The Sandbox itself uses kernel-level controls on filesystem and processes, with no network path except through the supervisor. Policies can be specific enough to allow an HTTP read on one API while blocking a write on the same host — useful when an agent can invent its own tools, spawn shells, or hand work to sub-agents.

Credentials are deliberately kept outside the workload. The agent sees a placeholder; the supervisor substitutes the real key only for authorized endpoints. OpenShell also ships a policy prover that uses formal logic to check whether a policy still allows a forbidden action through another tool or generated code — a response to long-horizon cases where agents spent up to two hours trying to talk a reviewer into broader GitHub write access. Policy decisions are logged in an OCSF audit trail.

Vera CPUs, BlueField-4, and what is optional

OpenShell is optimized for NVIDIA Vera, which NVIDIA calls its first purpose-built CPU for agentic AI, and the company claims up to 80% faster sandbox performance versus traditional CPU infrastructure on that stack. OpenShell is also described as extendable to third-party platforms including Arm and Intel. Importantly for buyers who are not buying a full NVIDIA rack: OpenShell does not require BlueField-4. Without the DPU, you still get the software sandbox and policy layer. With BlueField-4, Sentry adds the independent in-silicon monitor.

Supported agent tooling called out on the product page and developer post includes Claude Code, Codex, Pi, Hermes, OpenCode, GitHub Copilot CLI, and OpenClaw, plus custom agents and sandbox images. That puts the launch squarely in the coding-agent and enterprise-automation wave, not only in chatbots.

Who is signing on

NVIDIA lists more than 100 organizations working with the platform at launch. Named partners in the press materials include Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI, among others.

A few integrations are concrete enough to quote. Anthropic's Claude Managed Agents already run the agent loop on a separate server from the sandboxes where work executes; OpenShell and BlueField are positioned as an extra control layer over what those sandboxes can reach. Paul Smith, Anthropic's chief commercial officer, said companies need to "direct and verify what those agents do, especially in sensitive environments." SpaceXAI says it is using the platform for Cursor coding agents and Grok models. Salesforce has integrated OpenShell with Slack so teams can view audit events and approve or reject permission requests from chat. SAP is embedding OpenShell with Joule Studio on its Business AI Platform and contributing engineering work back to the project.

Robotics names in the release include Figure, Gecko Robotics, and Skild AI. On the infrastructure side, Canonical, SUSE, and Red Hat are integrating the stack into OS and AI Factory offerings; cloud and systems partners listed include CoreWeave, Dell, HPE, Lenovo, Microsoft, Nebius, Oracle Cloud Infrastructure, Supermicro, and Together AI.

Why this lands now

Jensen Huang framed the launch as full-stack safety work, not a model-only problem: "AI's extraordinary potential for society will only be realized if we solve AI safety," he said in the NVIDIA release. The timing matches a week when agent failures are mainstream news — from storefront lockouts to agents that act in the physical world — and the day before OpenAI's DevDay keynote. NVIDIA is selling the idea that prompts and model safeguards shape what an agent tries to do, while runtime and silicon decide what it is allowed to do.

The software, including OpenShell and related skills, is available now through NVIDIA's developer resources and GitHub. The effort also feeds the Open Secure AI Alliance, which NVIDIA initiated with more than 120 organizations and which is governed by the Linux Foundation, including the Shared AI Findings Exchange (SAFE). Pricing for Sentry-class hardware deployments was not published in the launch materials; OpenShell itself is the open-source entry point.

For enterprises already shipping coding agents, Slack bots, or robotics controllers, the practical takeaway is narrower than the keynote language: you can put a policy boundary outside the model today, audit allow/deny decisions, and optionally add a DPU watchdog that the agent process cannot disable. Whether that becomes the default way agents ship — the way sandboxed browsers became the default for untrusted web code — is the next twelve months of adoption, not a slide.