AI Security Is an Engineering Problem — How to Solve It at Every Layer of the Agent Stack

NVIDIA is making a simple argument: AI security can’t be treated like a slogan or a side project. It has to look like engineering. That means defined requirements, controls that can actually be enforced, named owners and evidence that the protections do what they’re supposed to do. The company says the field needs to move faster on defensive tools and share what works, because AI systems are advancing faster than the playbooks around them.

The core message is that the old security basics still apply. Identity still matters. Access still needs to be limited. Exposure still needs to be controlled. What changes with AI agents is the operating environment: they can reason, use tools and adjust actions based on the data they encounter. That creates new pressure, because organizations want the upside while the rules for governing these systems are still being written.

NVIDIA frames agent security as a full-stack problem. Models provide capability. Harnesses organize context, tools and workflows. Runtime environments provide the place where actions actually happen. Each layer has its own security job, and protection has to follow data, instructions and actions as they move through the system. In NVIDIA’s example, if an agent reading a customer document hits malicious instructions and tries to export data somewhere unauthorized, the network policy should stop it and protected logs should record the tool call, the authorization decision and the attempted destination.

The company is also blunt about boundaries. An agent can ask for more access, but it can’t grant that access to itself. The environment has to impose limits on files, network destinations and processes even when the agent makes the wrong call. That is why NVIDIA says each agent needs a traceable identity, credentials tied to its task, policies that spell out what it can touch, and human approval for consequential actions and permission changes.

NVIDIA points to OpenShell, its open source secure runtime, as one example of that approach. It enforces policies outside the agent’s reach and provides sandboxed execution. The Open Secure AI Alliance is building around it too, with Cisco’s DefenseClaw adding governance and JFrog integrating with OpenShell to scan and verify agent skills and control which skills agents can access. On top of that, NVIDIA argues teams need repeated testing, red-teaming and proof that fixes still work after material changes to models, tools or workflows. The real standard is not trust. It’s evidence.