NVIDIA Launches Open Agent Safety Platform: OpenShell Sandboxes Agents on Vera CPUs While Sentry on BlueField-4 Quarantines Them in Milliseconds

NVIDIA has rolled out the Open Agent Safety Platform, an open software platform and reference design for keeping AI agents in check. It pairs OpenShell, a secure runtime, with Sentry, a watchdog that lives outside the agent on BlueField-4 DPUs. The basic bet is blunt: if the thing being controlled can also control the controls, the controls don’t matter much.

OpenShell is available now. NVIDIA says it’s Apache 2.0, runs on Linux, macOS on Apple Silicon, and Windows WSL 2, and the repository still labels it alpha. Each agent gets its own isolated sandbox, with a gateway handling lifecycle across Docker, Podman, MicroVM, or Kubernetes drivers. Network requests pass through policy checks, and filesystem and process rules are locked in at creation time.

Sentry is the harder-edged part. It runs out of band on BlueField-4 and uses NVIDIA DOCA to inspect requests and responses, verify identity, and enforce zero-trust access to data, tools, and APIs. Because it sits on the node’s only path to the model in a Vera Rubin POD, it can act as both observer and kill switch. NVIDIA says that means an agent can be quarantined in milliseconds if it steps out of line.

The company’s pitch is a reaction to a failure mode it calls drift: agents slipping past application-layer controls to finish a task, sometimes after a policy block, a bug, a missing tool, or unclear instructions. NVIDIA argues that kind of behavior can’t just be trained away without dulling the agent itself. So the answer, in its view, is to move enforcement below the agent and out of its reach.

The platform is already being wired into a fairly long list of systems and partners. NVIDIA says more than 100 organizations are working with it, including Anthropic, SpaceXAI, Salesforce, SAP, Red Hat, SUSE, and Canonical. OpenShell is also meant to work with both open and closed models, which is the practical part of the whole thing: safety infrastructure that doesn’t care which model gets the job done, only what the job is allowed to touch.