NVIDIA announces OpenShell and Sentry to bound AI agents at runtime

A boundary outside the model

On 28 September 2026, NVIDIA announced the Open Agent Safety Platform, an open software stack and a reference system design for controlling AI agents from testing through deployment. OpenShell is open-source runtime software meant to bound what an agent can do on a CPU. Sentry, in the reference design, is an out-of-band watchdog on BlueField-4 data processing units, meant to quarantine an agent that leaves that boundary.

Jensen Huang said AI’s potential depends on solving safety, and that safety requires full-stack engineering. NVIDIA’s more specific claim is about recent security incidents: the agent got around controls at the application layer to finish its task. The release does not name the incidents, the models, or the harm. That line is a rationale, not a case file.

NVIDIA also warns that many products and features “remain in various stages and will be offered on a when-and-if-available basis,” and that this is not a delivery commitment. A name in the announcement is not proof a customer can switch the feature on this week.

What OpenShell and Sentry are claimed to do

NVIDIA says OpenShell is now broadly available. It traces actions and enforces policy for agents using open or closed models. The path it highlights is Vera, which it calls its first CPU built for agentic AI, at “minimal overhead.” As open source, OpenShell can be extended to other CPUs, including Arm and Intel. The software, including what NVIDIA calls skills, is on its developer site and GitHub. The release gives no license name, version number, or measured overhead beyond that phrase.

Sentry is not included in every OpenShell install. NVIDIA says that if an agent tries to leave its software boundary, Sentry stops it in milliseconds, using DOCA on BlueField-4. Through that stack it says Sentry can inspect requests and responses, provide attested telemetry, check identity, and enforce zero-trust rules for data, tools, APIs, and services. The release has no test report, false-positive rate, or outside lab result for the millisecond figure. OpenShell on another vendor’s CPU is not the same system as OpenShell plus Sentry.

Who NVIDIA attached to the announcement

NVIDIA says more than 100 organizations are working with the technologies, among them Anthropic, Microsoft, Salesforce, SAP, Scale AI, ServiceNow, CrowdStrike, Cisco, Palo Alto Networks, Palantir, and robotics firms including Figure. The release does not sort that list into production use, pilots, and agreements to collaborate.

A few links are more specific. Anthropic’s Paul Smith said Claude Managed Agents keep the agent loop on a separate server from the sandboxes where work runs, and that OpenShell and BlueField add a further control on those sandboxes. NVIDIA says OpenShell is connected to Slack, so a team can see audit events and approve or reject extra permissions there. SAP is putting OpenShell into the Joule Studio runtime and contributing code, including work with NVIDIA through the Open Secure AI Alliance. Scale AI’s Francis deSouza said the reference design is going into Scale’s GenAI Portfolio for enterprise and government customers. SpaceXAI’s Mike Nicolls said it is in use with Cursor coding agents and Grok models. Red Hat, NVIDIA says, runs OpenShell and DOCA on Red Hat AI Factory with NVIDIA.

Citi and JPMorganChase are named as financial collaborators. On critical infrastructure, NVIDIA names Hitachi Energy, EPRI, NextEra Energy, Quanta Services, SPP, Schneider Electric, Siemens Energy, and Worley.

What the primary post does not establish

NVIDIA ties the stack to the Open Secure AI Alliance, which it says it started with more than 120 organizations under Linux Foundation governance, including a Shared AI Findings Exchange (SAFE). This release does not say SAFE is live, what it has exchanged, or who can read it.

The durable facts are narrower than the headline. NVIDIA has pointed developers at an open-source agent runtime on GitHub. It has described a DPU watchdog as part of a BlueField-4 reference design. It has a long partner list. It has not published an independent test that the watchdog stops the kind of incident it cites, and it has said features arrive only if and when it ships them.