NVIDIA adds an independent safety layer for AI agents.
AI agents can write code, use tools and keep working long after a person steps away. NVIDIA’s September 28 Open Agent Safety Platform launch puts permission controls outside the agent’s workload and offers a separate hardware-backed watchdog. The aim is to give people stronger control over what agents can reach; the launch does not establish that agents are now safe in every setting.
- Maturity
- Emerging, stage 2 of 4
- Support
- 4 sources · institution
- Evidence detail
- How we know ↓
The person asking an AI agent to fix a bug or investigate a problem should not have to accept unlimited access to their files, credentials or shared systems. As agents work for longer and delegate tasks, an unexpected action can affect people who never gave the agent instructions. Useful autonomy needs boundaries that remain enforceable when the agent makes a mistake or tries another route.
Instructions inside a prompt are not the same as enforced permissions. A sandbox restricts where software runs, but the services, credentials and tools allowed through its boundary also matter. NVIDIA’s approach separates the agent’s task from the systems that decide what it may do, then adds an optional enforcement layer isolated from the host running the workload.
The agents remain responsible for choosing steps, calling tools and generating code. OpenShell 0.1.0 supplies the surrounding runtime: a sandbox limits filesystem and process access, while a supervisor outside the workload checks outbound requests. For configured HTTP, GraphQL and MCP traffic, policies can distinguish reading from writing. Real service credentials are substituted outside the agent workload for authorized requests. A formal policy prover checks modeled permissions against an operator-defined boundary; this is a check on the permission model, not proof that an agent’s goals or decisions are harmless.
What is NVIDIA’s Open Agent Safety Platform?
NVIDIA’s September 28 announcement brings together OpenShell runtime software and a reference system design with an optional hardware-backed watchdog called Sentry. It aims to enforce boundaries outside an agent’s workload. The announcement is not evidence that every agent or deployment is safe.
What does OpenShell do?
OpenShell surrounds an agent with runtime controls: a sandbox limits local access, while a supervisor checks outbound requests. For configured services, policies can distinguish a read from a write. Credentials are substituted outside the workload for authorized requests. Operators still decide which permissions to grant.
How is Sentry different from OpenShell?
Sentry is the optional hardware-backed monitoring layer in NVIDIA’s reference design, using BlueField-4 and DOCA. NVIDIA describes it as operating in an isolated trust domain. It is not a feature available on every computer, and Bright has not independently benchmarked its containment claims.
Does a sandbox make an AI agent trustworthy?
A sandbox constrains access; it does not establish that an agent’s decisions are sound. Allowed services and permissions can still enable harmful actions. Permission analysis checks a modeled boundary, while configuration, human review and independent evaluation remain important.
Based on the NVIDIA launch materials and technical documentation below; vendor claims remain attributed.
What was shown, and what wasn’t
Shown
On September 28, 2026, NVIDIA announced the Open Agent Safety Platform, pairing broadly available open-source OpenShell software with a reference system design featuring Sentry. Sentry is an optional watchdog running on BlueField-4 data processing units using NVIDIA DOCA. NVIDIA describes it as monitoring agent activity from an isolated trust domain and says it can quarantine an agent that crosses its boundary in milliseconds. Its technical walkthrough also reports adversarial tests in which agents with reduced safeguards tried for up to two hours to obtain permission to modify a protected GitHub repository. NVIDIA reports no protected writes in those tests when an AI reviewer used the policy analysis alongside runtime controls. Bright has not reproduced either result. The release says more than 100 organizations are working with the platform’s technologies; that participation is not a count of independently validated deployments.
Not shown · limits
- This is an Emerging security-platform record based on NVIDIA’s announcement, technical explanation and documentation. The cited launch materials do not establish independently measured reductions in incidents across real-world deployments.
- The millisecond quarantine claim is NVIDIA’s. Bright has not benchmarked response time, missed detections, false alarms or performance overhead. The reported protected-repository experiment is a bounded vendor test, not a guarantee against every escape or attack.
- OpenShell is available software; Sentry is an optional hardware-backed layer in a reference design. Its described BlueField-4 architecture should not be read as a universal feature on every computer. The release says some products and features remain at different stages of availability.
- Operators still choose the policy and the authority they grant. Formal verification concerns modeled permissions and assumptions, not every possible harmful action. NVIDIA describes analysis of combined permissions across multiple agents as ongoing work.
- Configuration and the surrounding system matter. NVIDIA’s security guidance identifies allowed endpoints as possible data-exfiltration channels. An authorized connection or action can still be harmful; infrastructure containment does not by itself establish trustworthy decisions or safe physical behavior.
Bright editorial interpretation
The practical possibility is giving an agent useful access without handing it every permission its task might conceivably need. NVIDIA’s walkthrough illustrates allowing a read while blocking a write to the same API. Permission-change proposals remain pending for human review by default, and the agent cannot approve its own request. The announcement also describes a Slack integration for inspecting activity and approving or rejecting requests. Bright’s interpretation: controls people can inspect and enforce could make delegated work more useful and accountable. Whether that translates into fewer incidents in everyday use still needs evidence.
Still open
How does the platform perform under independent adversarial testing, including compromised hosts, permitted external services and cooperating agents?
What are the detection, false-alarm and containment results across different workloads and supported hardware?
Can teams maintain narrow, understandable permissions as tasks change, without routinely approving broader access?
How we know4 sources · checked 2026-09-28 · no corrections
Original sources
- NVIDIA launches Open Agent Safety Platform to secure agents from testing to deployment · September 28, 2026 ↗ · institution
- NVIDIA Open Agent Safety Platform: a reference for continuous in-silicon agent monitoring · September 28, 2026 ↗ · institution
- Add runtime controls to AI agents with NVIDIA OpenShell · September 28, 2026 ↗ · institution
- OpenShell security best practices · NVIDIA documentation ↗ · institution
Institutions: NVIDIA
- Maturity
- Emerging
- Claim confidence
- medium
- Event date
- 2026-09-28
- Source published
- 2026-09-28
- Captured
- 2026-09-28
- Last source review
- 2026-09-28
- Editorial method
- AI-assisted source review
Bright compared this account with the linked original and supporting sources and kept reported, budgeted, projected, and observed claims distinct. Bright did not independently audit the underlying records.
Maturity describes the tested or operational setting. Confidence describes support for the particular claim; one does not determine the other.
Revision & correction history
2026-09-28 · Added the September 28 launch with runtime and hardware boundaries explained, vendor results attributed, and availability and independent-evaluation limits explicit.
2026-09-28 · Added concise questions explaining OpenShell, Sentry and the limits of sandboxing from the existing cited sources, plus related Bright work. Original publication and source dates are unchanged.
No corrections recorded.
Keep exploring
Explore the shared question in another setting. These connections do not imply replication.