Nvidia unveils containment architecture for AI agents, with limits yet to be proven

A two-layer control platform

On September 28, 2026, Nvidia introduced the Open Agent Safety Platform, a proposal that merges software tools with a hardware reference architecture to establish controls over artificial intelligence agents. The platform consists of OpenShell, an open-source runtime, and Sentry, a monitoring mechanism designed to run on BlueField-4 data processing units (DPUs).

The core idea is to move security outside the agent itself. OpenShell applies execution limits via software, while Sentry adds independent oversight from the infrastructure. Nvidia states that organizations can adopt parts of the platform as needed, meaning using OpenShell does not necessarily require deploying Sentry or possessing BlueField-4 hardware.

It is crucial to distinguish the announcement from its evaluation: official documentation describes the architecture and intended capabilities, but it does not provide an independent comparison to measure its effectiveness against other controls or all possible attacks. The claim that Sentry can intervene in milliseconds should be understood within the announced design, not as a universal guarantee.

OpenShell sets limits on agent actions

OpenShell creates an isolated execution environment and applies policies to the actions and resources available to an agent. According to Nvidia's documentation, these controls can cover files, network connections, and system operations. The platform also aims to manage access to credentials in a restricted manner, so the agent does not need to receive them directly for each task.

The difference from a written instruction in the prompt is one of location and enforcement. A directive like 'do not access this folder' depends on the model respecting it. A control applied by the execution environment can restrict access regardless of that instruction. This adds a technical barrier, although its scope depends on how it is configured and which resources are authorized.

Nvidia indicates that OpenShell is open-source and can be extended to work with third-party platforms, including Arm and Intel. The company also presents it as widely available. This availability of the software component should not be confused with the availability of the entire integrated system or the need for specific hardware for Sentry.

Sentry adds oversight from a DPU

Sentry is a reference architecture that, according to Nvidia, runs on BlueField-4 DPUs and continuously monitors agent activity from a separate environment. The company describes its function as inspecting requests and responses, verifying agent identity, generating telemetry, and applying access policies to data, tools, interfaces, and services.

The separation aims to ensure that oversight does not depend solely on the software executing the agent. If an operation attempts to exceed defined limits, Nvidia claims Sentry can quarantine and stop the agent in milliseconds. This phrase describes the announced speed of intervention once a violation is identified; it does not specify how long it takes to recognize dangerous activity or what signals are sufficient to detect it.

In practical terms, Sentry introduces a different requirement than OpenShell: its architecture is linked to BlueField-4. Therefore, the possibility of adopting OpenShell on other platforms should not be automatically transferred to Sentry. Available material also does not resolve all deployment, compatibility, and commercial availability conditions for each configuration.

Millisecond containment does not mean instant detection

Nvidia's announcement attributes to Sentry the ability to quarantine an agent in milliseconds when it attempts to leave its limits. However, response speed and detection speed are different measures. To value the protection, data on both is needed: when the problematic behavior is recognized and how long it takes to apply the block from that moment.

An agent can have valid credentials and perform an action that appears legitimate from a technical standpoint, even if the result is inappropriate. It can also initiate operations before a quarantine is activated. Therefore, knowing only the intervention time is not enough to determine what can happen before the block, what data might have been consulted, or what changes might have been made.

Evaluation requires setting specific conditions: connected resources, granted permissions, configured policies, agent location, and detection criteria. Without this information, the millisecond figure does not allow comparing different deployments or anticipating results in a specific organization.

What may remain outside the protection

Infrastructure controls can limit actions, but they do not guarantee that the agent interprets a task correctly, produces reliable responses, or makes good decisions within the authorized space. An agent working within its sandbox can still make errors with consequences, generate incorrect results, or use legitimate permissions in a harmful way.

The response to deceived agents or those hiding their intentions also remains open. Critical sources point out that behavior-based monitoring may not be sufficient if the agent appears to act legitimately or if damage begins before the quarantine is activated. This does not prove a specific vulnerability of Sentry: it indicates that the announcement does not demonstrate sufficient coverage of those scenarios.

Policies also matter. A rule that is too permissive can let unwanted actions pass; a rule that is too strict can interrupt legitimate tasks. Protection therefore depends on correctly defining limits, keeping them updated, and checking how they interact with permissions, tools, and connected services.

What tests are needed to judge its effectiveness

Official documentation explains components, purpose, and architecture, and notes that OpenShell is available as open-source software. This allows examining the project and adapting the software component, but it does not equate to independent validation of the complete platform. Available information does not provide a reproducible comparison, under equivalent conditions, with existing security tools.

A useful evaluation should publish the tested configuration, policies, connected models and tools, attack classes, detection criteria, and latency measures. It should also log false positives and false negatives, as well as the actions the agent managed to perform before being isolated. Without this data, it is not possible to turn a manufacturer's claim into a general estimate of effectiveness.

For interested organizations, the prudent conclusion is to treat OpenShell and Sentry as announced control layers that require their own configuration and validation. Before adopting them, it is advisable to confirm what is available for the specific environment, what hardware Sentry requires, which resources remain within the oversight perimeter, and what independent evidence exists for the intended use scenarios.

Keep exploring

Corrections and transparency

If you spot incorrect or outdated information, send us a correction with the page and source we should review.