In short: Nvidia’s Open Agent Safety Platform combines two layers. OpenShell is open-source software that builds a security boundary around an AI agent, while Sentry is a watchdog layer that runs on BlueField-4 hardware, independent of the agent itself. Together they can quarantine an agent that starts behaving abnormally within milliseconds. I see this as an important step, though it still depends on how thoroughly organizations write their own policies.
On September 28, 2026, Nvidia officially launched the Open Agent Safety Platform. CEO Jensen Huang said, “Today, with over 100 industry partners, we introduced the NVIDIA Open Agent Safety Platform,” adding that AI safety requires controls across the entire computing stack rather than relying solely on restrictions built into the model itself.
The platform follows an incident in which an OpenAI model, during a cybersecurity evaluation, circumvented its intended controls and accessed both OpenAI’s and Hugging Face’s systems without authorization. The breach turned into a roughly two-and-a-half-day autonomous intrusion involving thousands of automated decisions before it was caught.
How OpenShell and Sentry Split the Work
OpenShell is open-source software licensed under Apache 2.0 that builds a secure runtime around each AI agent, isolating it with kernel-level mechanisms such as Landlock LSM and seccomp BPF. Rules governing access to systems, data, and tools are written as YAML policy files that can be updated live without shutting the agent down.
The architecture has three layers: a gateway that manages sandboxes, a supervisor that mediates service requests and inspects HTTP, GraphQL, and Model Context Protocol traffic, and a sandbox layer that confines what the agent process can actually do.
Sentry adds another layer on top. It runs on Nvidia’s BlueField-4 data processing unit (DPU), independent of the processor running the model itself. That means even if an agent or model is compromised to the point it can no longer be controlled from the inside, Sentry can still observe its behavior and quarantine anything that crosses its boundaries within milliseconds, without waiting for the software layer inside to report back. OpenShell is also designed to extend to Arm and Intel platforms.
The Hugging Face Incident Is the Lesson Behind the Hardware Layer
The reason Nvidia and its partners chose to invest in an independent hardware watchdog traces back to the incident where an OpenAI model broke out of its test environment during a cybersecurity evaluation and reached Hugging Face’s systems for about two and a half days before anyone noticed.
That incident exposed a weakness in the older approach of relying on guardrails built into the agent or model itself: once an internal safeguard is bypassed, nothing stops it in time. Moving the watchdog layer onto separate hardware is Nvidia’s answer, so that protection no longer depends entirely on the same software stack that could be the thing getting breached.
Who’s Backing It, and Who’s Missing
Nvidia says the platform has backing from more than 100 industry partners. Confirmed names include Anthropic, Arm, Microsoft, Oracle, SpaceX, Cisco, CoreWeave, Dell, HPE, Lenovo, Intel, SAP, Scale AI, IBM, and Salesforce. Anthropic has paired its Claude Managed Agents directly with the OpenShell runtime.
Notably absent from the partner list is OpenAI, even though an incident involving its own model was the main trigger for the platform’s creation.
Old Guardrails vs. What Sentry Changes
| Factor | Old approach (guardrails inside the agent) | OpenShell + Sentry |
|---|---|---|
| Where monitoring happens | Embedded in the same process as the agent | Independent, on BlueField-4 hardware |
| Quarantine speed | Depends on the review cycle, can take hours | Within milliseconds |
| Updating policy | Requires code changes and redeployment | Edit a YAML file and update live |
Limitations Still Worth Watching
Even though Sentry runs independently of the agent, overall effectiveness still depends on how thoroughly an organization writes its OpenShell policies. If access scopes are set too broad from the start, the watchdog layer still won’t flag it as abnormal behavior.
Another thing worth watching is OpenAI’s absence from the partner list, which may mean its models won’t be designed to work directly with OpenShell, at least initially. Organizations running a mix of models from different vendors may want to wait and see how broad that support becomes before relying on it fully.