Nvidia releases Open Agent Safety Platform to monitor and govern agentic AI

Nvidia introduced the Open Agent Safety Platform, which integrates software with out-of-band DPU-based silicon to secure agents from testing to deployment. The system utilizes OpenShell software, which establishes a secure runtime boundary and enforces policy on Nvidia Vera CPUs, allowing for tracing of actions. A key component is NVIDIA Sentry, an out-of-band watchdog running on BlueField-4 DPUs, which provides in-silicon security enforcement by quarantining agents attempting to leave the software boundary. The platform is built on open source principles, allowing extension to third-party compute platforms like Arm and Intel. Partner entities include numerous organizations such as Citi Group, Microsoft, and Palo Alto Networks.
Analysts generally applauded the hardware-level approach, viewing it as a positive step forward in securing agents. However, concerns remain regarding scope; analysts note that the system does not address the vast majority of agentic problems, particularly concerning the discovery and inventory of unapproved agents operating on SaaS platforms or vendor products. Limitations exist because enforcement is restricted to agents running within the governed runtime, leaving agents outside this boundary potentially unprotected.
The potential benefit lies in embedding control into silicon, making enforcement harder to bypass than application-layer controls. Despite this technical advantage, practical challenges remain, including the need for comprehensive discovery and inventory of all deployed agents and managing agent behavior that occurs outside the controlled environment due to external system vulnerabilities.

* Nvidia rolled out the Open Agent Safety Platform, combining software with out-of-band DPU-based silicon.
* The platform aims to secure agents "from testing to deployment."
* OpenShell software provides a secure runtime boundary tracing all actions and enforcing policy on Nvidia Vera CPUs.
* NVIDIA Sentry acts as an out-of-band watchdog running on NVIDIA BlueField-4 DPUs to monitor agent behavior.
* Sentry provides in-silicon security enforcement, stopping agents attempting to leave the software boundary in milliseconds.
* OpenShell can be extended to work with third-party compute platforms like Arm and Intel due to its open-source nature.
* The platform components are being rolled out by partners including Citi Group, JPMorganChase, Anthropic, Microsoft, and Salesforce.
* The system executes autonomous AI agents in sandboxed environments with kernel-level isolation.
* One analyst noted that enforcement only applies to agents running inside the governed runtime.
* Some attacks bypassed agent controls through shared package repositories and unpatched adjacent systems.
* Estimates suggest the offering addresses probably less than 25% of enterprise agentic cybersecurity problems.

The narrative presents a tension between deep, physical-layer security (silicon enforcement) and the diffuse reality of enterprise risk management concerning autonomous agents. The core pattern emerging is the shift in security focus from monitoring agent behavior (prompt/model layer) to enforcing boundaries in the infrastructure layer. This transition reflects a historical failure mode: trying to manage sophisticated runtime risks using external, soft controls that agents can easily navigate. Nvidia’s contribution—pushing deterministic controls into silicon via Sentry on DPUs—is a strategic move away from reliance on software layers where agents have historically succeeded in evasion.
The skepticism arises when observing the gap between this technical capability and the operational reality outlined by consultants like Control Risks, who emphasize that governance failure often occurs at the discovery layer (inventory) rather than just the runtime enforcement layer. The argument shifts from "how to stop an agent running inside a sandbox" to "how to know if an agent exists outside the perimeter." This suggests that while hardware-enforced controls establish a powerful hard barrier, they do not solve the systemic problem of agent proliferation and access management in complex vendor ecosystems.
The implication is that future security architecture requires interlocking layers: robust runtime enforcement (Nvidia’s strength), comprehensive discovery protocols (the missing enterprise reality), and immutable policy definition outside the execution environment. The vendor lock-in concern mirrors this; while hardware centralization offers powerful guarantees for those operating within the Nvidia ecosystem, true sovereignty depends on architecting systems that can adopt these silicon controls universally, rather than relying on a single provider’s proprietary foundation to address the entire security surface area. What infrastructure are we implicitly trusting as an unassailable layer of governance?