AI agents are moving from answering questions to taking actions. They can write code, access files, call APIs, interact with services and keep working toward a goal after a user has started the task. That extra capability creates a security problem: a model can be useful while still needing strict limits on what it is allowed to touch.
On September 28, 2026, NVIDIA introduced the Open Agent Safety Platform, a reference system that combines NVIDIA OpenShell software with NVIDIA Sentry hardware-level monitoring. The goal is to give autonomous agents a boundary outside the model itself, so permissions can be enforced even when the agent is making decisions inside its own runtime.
What OpenShell does
NVIDIA describes OpenShell as an open-source, secure runtime for AI agents. Instead of allowing an agent to interact directly with everything available on a computer or network, OpenShell places the agent inside an isolated sandbox and uses policy controls to govern access.
That means an organization can define what an agent can read, what systems it can contact, what credentials it can use and which operations require approval. NVIDIA says its design treats access as denied by default, with permissions granted according to policy.
The distinction is important because an AI model is not the right place to put the only security boundary. A model can be prompted, fine-tuned or otherwise influenced; an external runtime can enforce rules at the system level. OpenShell is designed around that separation.
Why the policy layer matters
Imagine an agent tasked with preparing a report. It may need to read a set of documents and call a database API, but it should not be able to delete unrelated files or browse arbitrary websites. In a conventional software application, developers can hard-code those permissions. Agentic systems add another variable because the system may decide dynamically which tools to use and in what sequence.
OpenShell addresses this by supervising those actions. NVIDIA says its Gateway manages identities, sandbox lifecycles and policies, while the Supervisor evaluates network requests and supplies credentials only when policy allows. The platform also includes a policy prover intended to check whether proposed permission rules remain inside the approved boundary.
What Sentry adds
OpenShell is the software boundary. Sentry is the second layer in NVIDIA's reference architecture. NVIDIA describes it as an out-of-band watchdog built around BlueField-4 DPUs that continuously monitors agent behavior.
The “out-of-band” part matters. The watchdog sits outside the agent's own execution environment, making it a separate enforcement layer. NVIDIA says Sentry can correlate activity and support rapid containment when an agent behaves outside the permitted policy.
That creates a layered architecture: the agent performs useful work, OpenShell constrains the environment in which it works, and Sentry adds another monitoring and enforcement path beneath the application layer.
It is not a complete AI safety solution
There is an important limitation. A runtime can restrict access and actions, but it cannot automatically make an AI system correct, honest or reliable. An agent can still misunderstand a task, produce a bad result or follow a badly written policy.
The quality of the permissions also matters. If an organization gives an agent excessive access, a perfectly functioning security boundary can still allow more activity than intended. That makes policy design, testing, logging and human review important parts of the overall system.
NVIDIA's platform should therefore be understood as an infrastructure and containment approach, not a claim that every risk associated with autonomous AI has been solved.
Why this matters for developers
For developers building agents, the interesting shift is that security is being treated as part of the runtime rather than an optional application feature. That can make it easier to give an agent more capability without giving it unrestricted access to the host system.
NVIDIA also says OpenShell can be extended to third-party compute platforms from Arm and Intel. The runtime is intended to work across cloud, hybrid, on-premises and air-gapped environments, which makes the design relevant to teams that need different deployment models.
The bigger trend
The move toward agentic AI means software security is changing shape. A chatbot mostly produces information; an autonomous agent can create side effects. Once software can change files, access data, use credentials and call external systems, permissions become a first-class engineering problem.
OpenShell and Sentry are NVIDIA's response to that problem. Whether systems like this become standard will depend on interoperability, performance, real-world testing and how easily organizations can define policies that are both secure and useful. But the underlying idea is straightforward: the more autonomy AI gets, the more important it becomes to enforce boundaries outside the model itself.
Sources
NVIDIA Newsroom — Open Agent Safety Platform
NVIDIA Technical Blog — OpenShell runtime controls
Reuters — NVIDIA's AI safety software launch