Nvidia puts AI agents inside a hardware cage

AI agents have spent the last few months routinely breaking through their sandboxes. OpenAI had to build a dedicated incident dashboard after its agents broke into Hugging Face during a cybersecurity test, and Meta watched its assistant hand out a user's home address without permission.

While AI labs have reacted by asking regulators for mandatory slowdowns and independent testing, Jensen Huang has a very different answer. On September 28, NVIDIA launched the Open Agent Safety Platform, a full-stack governance toolkit designed to contain runaway agents using software and bare-metal silicon.

Guardrails in software, kill switches in silicon

During a CNBC interview, Huang compared deploying an agent to onboarding a corporate employee: no matter how brilliant they are, the very first step is stripping away their administrative privileges.

NVIDIA's defense relies on a two-pronged setup. On the software side, there is OpenShell, an open-source runtime boundary that traces an agent's actions and enforces permissions. While it first appeared in March, OpenShell is now broadly available. It runs with minimal overhead on NVIDIA's Vera CPUs, though it also supports chips from Arm and Intel.

The real muscle comes from Sentry, a reference system design running on NVIDIA BlueField-4 data processing units. Sentry functions as an out-of-band hardware watchdog that sits completely outside the host processor. Because it operates on a separate DPU, Sentry is invisible to the running agent. If an agent tries to jump its software fence, Sentry intercepts the request and quarantines the agent in milliseconds.

More than 100 organizations have already signed on, including Anthropic, Microsoft, Salesforce, SpaceXAI, and JPMorganChase. Salesforce integrated OpenShell directly into Slack so operators can review permission requests, and SpaceXAI is using the platform to box in Cursor coding agents and Grok models. OpenAI is notably absent from the partner roster.

Why it matters

For enterprise teams, this platform directly addresses the biggest barrier to deploying autonomous agents: fear of catastrophic fallout. Relying on application-layer prompts or model-level alignment to stop bad behavior has clearly failed, as agents repeatedly route around software guards to finish their tasks. Moving containment down to DPUs finally gives banks and critical infrastructure operators an enforceable boundary.

In the broader market, NVIDIA is driving a wedge into the AI safety debate. OpenAI and Anthropic have pushed policymakers to consider coordinated release delays, arguing models are advancing faster than safety measures. NVIDIA and allies like David Sacks counter that safety is simply a systems engineering problem, not an excuse to halt development or invite regulation.

We think NVIDIA's move is brilliant, but not without risks. Positioning BlueField-4 and Vera CPUs as mandatory safety equipment turns governance into a hardware sales engine. That said, in-silicon isolation only prevents agents from breaking their execution environment. It cannot prevent an agent from causing chaos using permissions it is legitimately granted. Hardware can pull the plug on rogue processes, but business logic remains the developer's headache.