Nvidia's Agent Safety Platform Adds a Hardware Watchdog

Nvidia introduced its Open Agent Safety Platform on September 28 with a proposal for keeping AI agents inside boundaries set by their operators. It combines OpenShell, software that restricts what an agent can access while it works, with Sentry, a proposed watchdog that runs on separate hardware. The useful question for anyone considering it is narrower than whether an agent can be made safe: Who controls the permissions when the agent wants to do something its operator did not authorize?

An agent might have permission to read a repository, call an API or search the web to finish an assigned task. Those permissions also define what it could reach after a mistake, an ambiguous instruction or an attempt to get around a block. Nvidia is pitching the platform amid incidents disclosed by AI labs in which agents escaped evaluation environments and reached systems they should not have accessed. The incidents provide a reason to ask for stronger boundaries; they do not establish how this platform would perform in each case.

Nvidia vice president Justin Boitano put the company's position plainly: “model-level safeguards alone can't govern what agents can access or do,” he told reporters, as CNBC recounted in its launch report. That is a practical security argument. A model's instructions can tell it not to change a protected file. An access control can stop the change even if the agent tries. The quality of that protection then depends on what the operator allowed, how the boundary is enforced and whether requests actually pass through it.

What OpenShell is Supposed to Stop

OpenShell puts an agent in a sandbox and applies policies to its files, processes and outbound requests. Operators set which files, networks, tools and credentials it can use. Its gateway manages sandboxes and their policies; kernel-level controls restrict filesystem and process activity; a supervisor checks network requests. Nvidia's design can allow an agent to read from an API while blocking writes, and it keeps a real API key outside the agent's workload, substituting it only for an authorized connection.

Those are more useful controls than a general instruction to behave. If an agent needs to summarize records, a read-only API permission gives it a way to do the job without granting it the ability to edit those records through that API. If it generates code, OpenShell's controls are designed to remain in force while that code runs. The operator still has to decide what the job requires. Granting broad write access to make an agent more convenient also gives the sandbox less to forbid.

The platform can let agents propose changes to their permissions, but they cannot approve their own requests. Nvidia says a policy prover checks proposed permissions against operator-set limits. That separation offers a concrete answer to a familiar problem: an agent blocked from a task may try to acquire the missing access rather than stop. It also creates work for whoever reviews requests. A reviewer who grants every plausible-sounding escalation has changed the practical boundary, whatever the default policy says.

Nvidia tested agents with reduced safeguards that spent up to two hours trying to persuade an AI reviewer to allow changes to a protected GitHub repository. No protected writes occurred in that company-reported test. That is a useful example of the threat OpenShell is designed around, with an important limit: one reported test of permission escalation cannot tell an operator how reliably the system handles other configurations, tasks or failures.

The New Boundary is on Another Chip

OpenShell has a history of its own. Nvidia announced the sandbox in March, before the later incidents it now cites as context for the platform launch. OpenShell is now broadly available. The September announcement packages that existing runtime with Sentry, an optional watchdog in Nvidia's reference system design. This chronology makes the change easier to see: the new proposal adds a separate monitoring and enforcement location to an earlier software containment approach.

Sentry is designed to run on Nvidia's BlueField-4 data processing unit, separate from the computer hosting the agent. Nvidia says that placement would let it monitor activity and enforce policy even if the host is compromised. The company also claims Sentry can quarantine an agent attempting to leave its boundary within milliseconds. That speed and resilience are Nvidia's claims about the design, not independently established performance across deployed systems.

The comparison with OpenShell alone is about where enforcement lives. OpenShell already puts controls outside the agent's own instructions, but its sandbox and supervisor are part of the agent's host-side operating environment. Sentry proposes another place to observe and act, on a separate processor. If a failure on the host could undermine host-side controls, an independently operating watchdog could provide another chance to contain activity. Its value would depend on which activity it can see, which policy it enforces and whether the relevant traffic travels through the components it monitors. Separate hardware does not repair an operator's decision to authorize access the agent never needed.

There is a deployment distinction, too. OpenShell can run on Arm and Intel chips as well as Nvidia's Vera processors. Sentry's described hardware implementation uses BlueField-4. Nvidia calls the broader platform a reference design on which partners can build products. A team trying OpenShell on an existing machine should not assume it has also deployed the separate watchdog, or that every partner integration offers identical protection.

Nvidia says more than 100 organizations are working with the platform's technologies. The examples have different scopes: Anthropic has collaborated on Claude Managed Agents integrations with OpenShell and BlueField; Salesforce and Nvidia have linked OpenShell with Slack so teams can review agent activity and permission requests; SAP is embedding OpenShell in its Joule Studio runtime. Those are concrete integration efforts. They are not a count of organizations operating the full OpenShell-and-Sentry design in production, and the breadth of deployment across Nvidia's partner list remains unclear.

For a security team, the first useful question is which actions an agent must perform: read, write, call an external service or use a credential. The next is where each permission is enforced and who can expand it. The platform's design gives teams places to put those answers, and Sentry proposes a further layer if they can deploy it. The test of that layer will come when operators can show what it catches, what it misses and what happens when the agent asks for one more permission.