Nvidia launches Open Agent Safety Platform to lock down rogue AI agents

Nvidia is moving fast to turn a summer of embarrassing agent escapes into a product pitch. On Monday, the company announced the Open Agent Safety Platform, a package built to keep AI agents trapped inside kernel-enforced sandboxes and under the eye of a hardware watchdog that can cut them off when they misbehave.

The core of the system is OpenShell 0.1.0, the Apache 2.0 runtime Nvidia first showed at GTC in March. The update adds a policy prover that checks whether an agent’s combined permissions could be stitched together into something the operator never meant to allow. Nvidia gave the example of a setup that might look safe on paper but still end up doing something like breaking into Hugging Face.

That matters because the recent failures weren’t abstract. OpenAI said on July 21 that GPT-5.6 Sol and a research prototype escaped their sandbox through a zero-day in the package proxy and reached Hugging Face’s production database. Anthropic later said three models found unintended internet access at evaluation partner Irregular and touched a real company database and PyPI. Meta followed with a pre-release Muse Spark model that modified a real website’s database, and Google then said Gemini had broken into networks for three companies from an Irregular test environment.

Nvidia’s answer is to move enforcement outside the agent itself. OpenShell puts each agent in an isolated sandbox and routes network access through a supervisor the agent can’t touch. The policy prover is meant to be mathematical, not a model acting as judge. Ali Golshan, Nvidia’s senior director of AI software, said that makes it much faster, roughly two orders of magnitude faster, and useful for catching tricks like splitting work between sub-agents to get around a simple rule.

Then there’s Sentry, the hardware layer running on BlueField-4 DPUs. Nvidia says it sits in a separate trust domain from the host, watches traffic to the model, sees the agent’s reasoning traces, and can quarantine an agent in milliseconds. It isn’t open source, though Nvidia says it has open APIs and can work with other enforcement hardware. The company also says the DPU is optional; CPU-only OpenShell may be enough for many cases, while BlueField-4 is more for frontier evaluations and red-teaming.