Digital Security
Why Nvidia Put a Lookout on Another Chip to Contain AI Agents
Nvidia combines OpenShell with a fiscal on the BlueField-4 chip. Understand how the two layers limit AI agents and why they are not an absolute guarantee.
By Ederson Andrade · October 1, 2026 · 6 min read
Audio
Listen to this article
7 minutes, approximately
An AI agent can receive a task, open files, execute code, and call services while trying to complete it. If its permissions are too broad, a misinterpreted instruction or unexpected behavior can lead the agent to mess with data that was not part of the job. On September 28, 2026, Nvidia presented an answer to this problem: the Open Agent Safety Platform, which combines software-imposed limits with a surveillance layer installed on another processor.
The two pieces have different functions. O OpenShell It places the agent in an isolated environment and controls which files, programs, and services it can reach. O Sentry, presented as a reference design for the BlueField-4 processor, adds a proctor outside the agent's main environment. According to Nvidia, this proctor can interrupt and quarantine an agent who tries to exceed the defined limits. The proposal is interesting because the agent should not be able to easily change the mechanism that watches him.
What OpenShell prevents before the action happens
OpenShell is a open source maintained by Nvidia. It runs each agent in a Sandbox- A space with limited access to files, processes, and the network. The organization sets a policy for each task. By default, the agent is not given direct access to any web address or the actual credentials of the services they use.
When the agent tries to talk to an external service, an out-of-sandbox supervisor checks the request. The policy can only allow a specific target, method, or operation. The system also reviews proposals to change permissions before they are applied. This is different from simply writing at the prompt "do not delete files": the restriction is executed by the environment where the program runs, even if the model ignores a textual statement.
The official diagram below shows three agents in separate sandboxes. Connections to services and between agents go through the permissions defined in OpenShell; each agent is not automatically granted the same access as the others.
Source: Nvidia's technical explanation of OpenShell.
Why put another chip to watch the agent?
A sandbox helps limit actions, but Nvidia proposes a second layer for systems where agents work for a long time or are given access to important tools. O BlueField-4 is a DPU (data processing unit): A processor dedicated to infrastructure tasks such as networking and security, separate from the CPU and GPU that run the main loads. In the Featured architecture, Sentry runs on that DPU and tracks agent interactions, policy decisions, and access to tools and data.
This separation means that Trusted domain. If the agent or a program it uses compromises the system where it works, a protection installed in the same environment can be disabled or tampered with. An inspector running on separately managed hardware is more difficult to reach from the sandbox. In the Vera Rubin POD systems described by Nvidia, BlueField-4 is in the path through which the agent accesses the model; this point allows it to observe requests and stop the flow when a rule is violated.
Think of an agent authorized to read invoices and prepare a report. OpenShell can flush the read folder and API required for the report, but block the deletion of files and sending data to an unknown address. If the agent tries to break out of these boundaries, Sentry would add an independent observation of the main environment and, according to Nvidia, could quarantine it in milliseconds. This is an example of how it works, not a test of TecEdi or a description of a real incident.
The chip does not "understand" whether an agent's decision is good in all contexts. It observes actions and applies policies within the points that the architecture can control. The practical difference is that it does not depend only on the obedience of the model or a warning displayed in the application.
Does this solve the problem of out-of-control agents?
There is no basis for treating the platform as an absolute guarantee. A policy that allows excessive access can still authorize an unwanted action. An agent can also cause damage by using a tool that it legitimately received. And the advantage of the separate inspector depends on whether the relevant paths actually pass through the monitored layer; a misconfigured integration or an alternate path can weaken protection. These are consequences of the permissions architecture, not demonstrated failures of the product.
Nvidia claims that Sentry can contain an agent in milliseconds, but the materials consulted do not present an independent test that allows confirming this latency in different loads and configurations. The company itself describes Sentry as a Optional layer of a reference design. OpenShell is available as open-source software and can be adapted to platforms from other manufacturers, including Arm and Intel. Having access to OpenShell, therefore, does not mean that the BlueField-4 layer is installed.
Before adopting such a system, a team still needs to answer concrete questions: What files and APIs does each agent really need? Who approves policy changes? How will access logs be analyzed? What actions should a person continue to give final confirmation? The separate layer reduces reliance on a single defense mechanism, but the quality of permissions and operation remains critical.
What changes from the announcement
The value of the proposition lies in treating agent security as a property of the environment where it runs, rather than as a promise made by the model alone. OpenShell already offers verifiable limits for individual tasks. Sentry attempts to keep a second point of control out of the agent's reach on compatible infrastructure. The more autonomy and access an AI system receives, the more important it is to know who sets your limits, who can change them, and who can stop you.