Putting AI Agents on a Leash

AI agents are becoming increasingly capable of doing real work on their own, but giving them the ability to browse files, call APIs, run code, and interact with other systems creates some obvious security problems. NVIDIA believes those problems will require more than simply training agents to behave themselves. Its new Open Agent Safety Platform is designed to place an independent security layer around agents, with enforcement extending all the way into hardware.

Zero trust

The platform combines NVIDIA OpenShell, an open source runtime for autonomous agents, with NVIDIA Sentry running on BlueField-4 Data Processing Units (DPUs). OpenShell handles the agent sandbox and defines what an agent is allowed to do, while Sentry provides a separate monitoring and enforcement system that remains outside the agent's control.

OpenShell runs agents inside isolated environments and uses policies to specify which files, networks, processes, tools, and credentials they can access. Those policies can be checked before an agent begins working and continuously enforced while it runs. NVIDIA describes the approach as zero trust: rather than assuming the agent will follow its instructions, the surrounding system limits what it can actually do.

Stopping drift before it happens

That distinction becomes increasingly important as agents are allowed to operate for longer periods of time, where the chances of drift increase — that is, when an agent's actions begin to depart from its intended task or operating constraints. That could happen because of ambiguous instructions, a software bug, a blocked action, or simply because the agent has spent a long time trying different approaches to solve a difficult problem.

The additional Sentry layer moves some of those protections away from the host system entirely. Running on a BlueField-4 DPU, Sentry can observe agent activity and enforce policies from hardware that the agent itself cannot access. NVIDIA DOCA connects this hardware layer with OpenShell policies while correlating model interactions, policy decisions, and access to tools and data. The resulting activity record can be used to detect unusual behavior or investigate what an agent was doing before something went wrong.

Controlling the next step

NVIDIA's architecture also puts an emphasis on the connection between an agent and its AI model. Since the agent needs another inference step before it can decide what to do next, controlling that path provides both a monitoring point and a way to stop the agent. In Vera Rubin POD systems, BlueField-4 sits directly on that path, allowing policies to be enforced independently of the host.

The overall platform is divided into application, runtime, and infrastructure layers. Applications contain the models, tools, data, and other components needed to perform a task. OpenShell provides the runtime responsible for isolation and policy enforcement, while the underlying hardware provides compute, networking, storage access, and optional independent monitoring.

NVIDIA is optimizing the system for Vera CPUs and BlueField DPUs, but says Open Agent Safety Platform can also work with other hardware. OpenShell is available under the Apache 2.0 license, providing an open foundation for developers experimenting with autonomous agents without requiring the agents themselves to also serve as their own security guards. You can find more information about the Open Agent Safety Platform in NVIDIA's blog post.