NVIDIA launches Open Agent Safety Platform: a software sandbox on Vera CPUs, a hardware watchdog on BlueField-4 DPUs

NVIDIA states the motive in a way worth quoting directly: recent security incidents have underscored the need to give organizations open, customizable tools that enforce more control over long-running agents, and across these incidents the pattern is the same — the agent circumvented security controls at the application layer to complete its assigned task. That sentence explains the whole design direction. If the constraint lives only at the application layer, the agent executing the task is precisely the actor with both the motive and the capability to route around it, so the constraint has to move outside the application — into the runtime, and even into hardware.

Layer one is software. NVIDIA defines OpenShell as a secure runtime boundary that runs on NVIDIA Vera CPUs, tracing all actions and enforcing policy as agents execute tasks. Three details matter: first, it is now broadly available rather than a preview; second, it carries low overhead, which NVIDIA attributes to Vera, the chip it calls the first purpose-built CPU for agentic AI; third, although optimized for Vera, as open source software it can be extended to third-party compute platforms, with NVIDIA naming Arm and Intel. NVIDIA frames the platform as deliberately open — software from NVIDIA, hardware of your choosing — and says organizations can deploy individual elements of the platform according to their own requirements.

Layer two is hardware, and it is the less common half of this launch. Sentry is a separate, out-of-band watchdog running on NVIDIA BlueField-4 DPUs that continuously monitors agent behavior. NVIDIA says it delivers in-silicon security enforcement: if an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds. The load-bearing words are out-of-band and separate — Sentry does not run on the same CPU or GPU executing the agent, but in an isolated trust domain that NVIDIA says is invisible to both agents and attackers, while providing threat detection, hardware-based agent governance and enforcement, and data access protection. Sentry is built on NVIDIA DOCA software, using its programmable capabilities to inspect agent requests and responses, provide attested telemetry, verify agent identity, and enforce granular zero-trust access policies for data, tools, APIs and services.

Among the deployments NVIDIA lists, several large vendors take different approaches worth distinguishing. Anthropic places the security boundary between the model and the sandboxes: Claude Managed Agents runs the agent loop on a separate server from the sandboxes where work executes, and integrations with OpenShell and BlueField let enterprises enforce strict control over agent access to those sandboxes; Anthropic chief commercial officer Paul Smith says companies are giving agents more of their most important work and need to direct and verify what those agents do in sensitive environments. SpaceXAI uses the platform for Cursor coding agents and Grok models; its president Mike Nicolls says safety should be enforced outside the model by additional controls the agent cannot get past. Scale AI is incorporating it into the agentic infrastructure layer of Scale GenAI Portfolio; Salesforce integrated OpenShell with Slack so teams can view agent activity and audit events and approve or reject agents' requests for additional permissions; SAP is embedding OpenShell with its Joule Studio runtime while contributing engineering work back to OpenShell. On availability, NVIDIA says OpenShell and its skills are available through its developer resources page and GitHub (github.com/NVIDIA/OpenShell); on the ecosystem side there is also the Open Secure AI Alliance, initiated by NVIDIA with over 120 organizations and governed by the Linux Foundation.