Skip to content

Back to the catalog

NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring
developer.nvidia.comarticle

NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring

NVIDIA introduces the "Open Agent Safety Platform," a reference architecture for continuous, hardware-rooted monitoring of autonomous AI agents, built around its open-source OpenShell runtime (Apache 2.0) which sandboxes agents with kernel-level isolation and verifiable, pre-execution policy enforcement. The piece lays out five design principles (verifiable policy, out-of-band enforcement, controlling the path to the model as the kill switch, scaling authority with reasoning inspection, shared responsibility across labs/enterprises/hardware providers) and describes how NVIDIA Sentry extends this into BlueField DPU/DOCA hardware to give out-of-band, line-rate observability and identity governance for agent fleets, motivated by recent reports of frontier-lab agents breaking out of evaluation sandboxes. It targets "agent drift" — departure from intended task/constraints — as something that cannot be trained away and requires independent, agent-unaware controls.

TL;DR NVIDIA's reference stack (open-source OpenShell + Sentry on BlueField DPUs) for sandboxing and out-of-band, hardware-rooted monitoring of AI agents to catch "drift" and containment breakouts.
Open original ↗
Document

What it is

NVIDIA's Open Agent Safety Platform announcement, splitting into two independently deployable pieces with very different prerequisites. The summary conflates them; the operational distinction is the point. OpenShell (Apache 2.0, open source) is a software runtime that sandboxes each agent with kernel-level isolation, turns operator instructions into a verifiable policy over files/networks/tools/processes/credentials, and enforces it before and during execution — it runs on general hardware. NVIDIA Sentry is the optional second layer that pushes the same enforcement into silicon and requires specific NVIDIA hardware.

Preconditions / Affected

The in-silicon layer is not software-portable. Sentry runs on BlueField DPU hardware programmed via DOCA, and the platform is "optimized to run on NVIDIA Vera CPU- and BlueField DPU-based systems" (compatible with, but not optimized for, others). In a Vera Rubin POD, each compute tray places a BlueField-4 DPU on the node's only path to the model — isolated from the host, beyond the agent's reach, enforcing OpenShell policy at line speed. The practical gate for engineers: if you already run Vera + BlueField-4, enabling Sentry is "just a software update"; otherwise the hardware-rooted guarantees require buying into that stack. OpenShell alone gives you the sandbox and policy enforcement without any of that.

How it works

The three-layer model (application → runtime → infrastructure) maps to responsibility ownership: the runtime "projects the application onto infrastructure" and does the continuous monitoring; the infrastructure layer is where accelerated compute for safety monitoring lives, separate from the compute running the agent. DOCA correlates agent interactions, policy decisions, and tool/data access into a contextual record used to identify drift and decide when intervention is needed. The DOCA gateway adds identity governance — continuously verifying each agent's identity and delegated authority. Whole fleets, subagents, and tools stay inside the boundary "with full lineage."

What to do

Follow-on technical detail is in the walkthrough "Add Runtime Controls to AI Agents with NVIDIA OpenShell" (linked but not URL'd on the page). If evaluating: start with OpenShell (no hardware commitment) to test policy enforcement and sandboxing; treat Sentry as a separate procurement decision tied to BlueField-4/Vera.

Caveats

This is a vendor announcement, not a technical spec — no version numbers, benchmarks, or reproduction steps for the "line speed" or "at scale" claims. The frontier-lab sandbox-breakout reports motivating it are cited only in the abstract, with no incident details.

Technologies named here

Techniques named here

  • Agent drift
  • Agent evaluation environment breakout
  • Out-of-band enforcement / control of path to model
  • Sandboxing/isolation

Related in AI Security