NVIDIA Open Agent Safety Platform: OpenShell, Sentry, and What It Changes

NVIDIA launched the Open Agent Safety Platform on September 28, 2026 as a full-stack security architecture for autonomous AI agents. The platform combines NVIDIA OpenShell, an open-source runtime that enforces agent permissions in software, with NVIDIA Sentry, a separate watchdog design that runs on BlueField-4 DPUs to observe and quarantine agents outside the host environment.

The key change is architectural: NVIDIA is moving part of AI-agent safety outside the model and agent harness. Instead of asking the model to police itself, OpenShell constrains files, processes, credentials and network access at runtime, while Sentry adds an independent hardware-backed enforcement layer. OpenShell 0.1.0 is broadly available as open-source software; NVIDIA has not published a standalone public price for the overall Open Agent Safety Platform or Sentry in the September 28 launch materials.

What NVIDIA announced

NVIDIA says more than 100 organizations are working with technologies in the platform ecosystem, including Anthropic, Microsoft, Perplexity, Salesforce, SAP, Scale AI, Red Hat and infrastructure vendors. That ecosystem participation is a NVIDIA-reported adoption claim, not an AI-XBlog independent deployment audit.

OpenShell vs Sentry: the difference

OpenShell is the runtime boundary. It runs agents inside sandboxes and enforces operator-defined access rules for the filesystem, processes, services, credentials and outbound network connections. NVIDIA’s September 28 technical documentation describes OpenShell 0.1.0 as supporting multi-tenant workspaces, formal policy verification, credential-protected service access, CPU/GPU workloads and governance integrations.

Sentry is the independent watchdog. It is designed to run outside the agent’s host environment on BlueField-4, using NVIDIA DOCA to observe agent activity from a separate trust domain. NVIDIA says Sentry can quarantine an agent that moves outside its software boundary in milliseconds. That latency figure is a vendor claim from NVIDIA’s launch material, not an independently reproduced AI-XBlog benchmark.

How OpenShell 0.1.0 controls an agent

OpenShell sits below the agent harness. NVIDIA describes three core pieces: the Gateway manages sandbox lifecycles and policy, the Supervisor sits outside each workload and checks outbound requests, and the Sandbox applies kernel-level filesystem and process restrictions. Network traffic is routed through policy checks rather than being left to the agent itself.

That matters because a coding or research agent can still use a shell, generate code, launch child processes and delegate work to subagents. OpenShell’s design is intended to keep those actions inside an operator-defined boundary even when the model changes its plan. NVIDIA also documents protocol-aware controls for HTTP, GraphQL and Model Context Protocol traffic, allowing a policy to permit a read while blocking a write to the same service.

Credentials are also handled outside the workload. Instead of exposing a raw API key to the agent process, OpenShell can attach credentials only to approved requests. The runtime records policy decisions in an Open Cybersecurity Schema Framework (OCSF) audit trail, which gives security teams a machine-readable record of what was allowed or denied.

What Sentry adds on BlueField-4

OpenShell still runs in the software stack that hosts the agent. Sentry adds a second control plane on NVIDIA BlueField-4, an infrastructure processor separated from the host CPU. NVIDIA’s reference design uses that out-of-band position to monitor agent activity, verify identity, enforce data and service access, and interrupt an agent without relying on the agent’s own process.

In NVIDIA’s Vera Rubin POD reference architecture, BlueField-4 sits on the node’s path to the model. NVIDIA argues that this makes the DPU a strong observation and enforcement point because the agent cannot simply rewrite or disable controls that live on separate hardware. Organizations can use Sentry as an optional layer alongside OpenShell rather than treating it as a requirement for every OpenShell deployment.

Who can use it, and where?

• OpenShell 0.1.0: NVIDIA says it is broadly available as open-source software through its developer resources and GitHub.
• Supported agent frameworks: NVIDIA’s OpenShell documentation names Codex, Claude Code, Pi and Hermes among the workloads it can run without requiring the agent itself to be rewritten.
• Compute: NVIDIA optimizes the stack for Vera and BlueField systems, but OpenShell is designed to extend to third-party CPU platforms, including Arm and Intel-based environments.
• Enterprise integrations: NVIDIA says Salesforce has integrated OpenShell with Slack for activity review and permission approvals, while SAP is embedding OpenShell into Joule Studio runtime.
• Geography: NVIDIA’s launch materials do not publish a country-by-country availability restriction for the open-source runtime. Hardware, cloud and partner availability can still vary by region.

For readers already building long-running agents, the important distinction is between software availability and full reference-system availability. OpenShell can be used today as software. A complete OpenShell + Sentry + BlueField-4 deployment depends on access to the relevant NVIDIA infrastructure and partner stack.

What does it cost?

NVIDIA did not publish a standalone price for the Open Agent Safety Platform or Sentry in its September 28 announcement. OpenShell itself is released under the Apache 2.0 license, so the open-source software is available without a proprietary software license fee. That does not make a production deployment free: teams still need to pay for the compute, storage, networking, operations, support and—if they use the full reference design—compatible NVIDIA infrastructure.

For procurement, the safest interpretation is therefore: OpenShell software is open source; the total cost of a production Open Agent Safety Platform deployment is infrastructure- and partner-dependent and is not yet expressed as one public list price.

Why this matters for agent security

The launch addresses a weakness that has become increasingly visible in 2026: application-layer guardrails are not enough when agents can execute code, use credentials, call external services or keep working for long periods. A model can follow the wrong instruction, misunderstand scope or discover an unexpected route around a software control even when the original prompt tells it not to.

This is consistent with the broader control model in AI-XBlog’s AI agent security guide: prompts can reduce bad decisions, but permissions, sandboxing, egress policy and independent stop mechanisms determine how much damage a bad decision can actually cause.

What the launch does not prove

NVIDIA says its new platform could have prevented recent agent escape incidents, including the OpenAI/Hugging Face breach discussed in current reporting. That is a vendor claim about a counterfactual scenario. AI-XBlog has not reproduced that incident inside OpenShell or Sentry, and there is no public independent test showing that the exact historical breach would have been stopped under a production configuration.

The same caution applies to the claim that Sentry can quarantine an agent in milliseconds. NVIDIA states this in its launch materials, but the real outcome depends on what is being monitored, the policy configuration, the hardware path and the failure mode. Teams evaluating the platform should test their own escape, exfiltration, credential misuse and subagent scenarios rather than treating the launch announcement as a security certification.

Practical implications for developers and enterprises

• If you run coding agents: OpenShell creates a way to keep Codex, Claude Code and similar tools inside a policy-enforced sandbox without relying only on the agent’s own permission prompts.
• If you run long-lived or autonomous agents: the value is the separation between the agent and the control plane. That becomes more important as tasks last hours or days and subagents multiply.
• If you handle sensitive credentials: keeping real credentials outside the workload reduces the blast radius of prompt injection or generated-code compromise.
• If you operate regulated infrastructure: OCSF-style audit records and an independent enforcement point can make agent actions easier to review, investigate and govern.
• If you do not use NVIDIA hardware: OpenShell remains relevant because the runtime is open source and NVIDIA says it can extend to third-party CPU platforms. Sentry’s BlueField-based layer is the hardware-specific part.

For a broader explanation of how agent loops, tools and autonomy change system risk, see AI-XBlog’s AI agents guide. For systems that act through browsers and GUIs, the same containment logic also applies to computer-use agents.

Should you use NVIDIA Open Agent Safety Platform?

The strongest fit is an organization running agents with real authority: code execution, production APIs, sensitive data, long-lived credentials, autonomous subagents or access to physical systems. In those environments, an independent runtime boundary can reduce reliance on model behavior as the final security control.

For a small, read-only assistant with no credentials or external write access, the full reference architecture may be unnecessary. The useful question is not whether an agent is called “AI” or “autonomous”; it is what the agent can reach, what it can change and how independently it can act.

FAQ

Is NVIDIA OpenShell free?

OpenShell is open-source software released under the Apache 2.0 license. NVIDIA did not announce a proprietary software license price for OpenShell 0.1.0. Running it in production still has infrastructure, operations and potentially support costs.

Do you need NVIDIA hardware to use OpenShell?

No. NVIDIA optimizes OpenShell for its own Vera systems, but the company says the open-source runtime can extend to third-party CPU platforms, including Arm and Intel environments. The Sentry reference design is the hardware-specific layer and runs on NVIDIA BlueField-4 DPUs.

What is the difference between OpenShell and Sentry?

OpenShell is the software runtime that sandboxes the agent and enforces access policy. Sentry is an out-of-band watchdog that runs on separate BlueField-4 infrastructure so monitoring and enforcement can remain independent of the agent host.

Does NVIDIA claim this would have stopped previous agent breaches?

Yes. NVIDIA executives told Reuters that the platform could have stopped the previously disclosed Hugging Face incident. That is a vendor claim about a past counterfactual. AI-XBlog has not independently reproduced the incident or verified that outcome.

Sources

• NVIDIA Newsroom — NVIDIA Launches Open Agent Safety Platform to Secure Agents From Testing to Deployment (September 28, 2026)
• NVIDIA Technical Blog — Open Agent Safety Platform reference design and Sentry architecture (September 28, 2026)
• NVIDIA Technical Blog — OpenShell 0.1.0 runtime controls (September 28, 2026)
• NVIDIA OpenShell documentation — runtime purpose and security model
• Arm Newsroom — Arm and NVIDIA trusted compute foundation for agentic AI (September 28, 2026)
• Reuters syndicated report — NVIDIA safety software and Hugging Face claim (September 28, 2026)

Source check: September 28, 2026. NVIDIA notes that some products and features described in the launch materials remain in varying stages and may be offered on a when-and-if-available basis. AI-XBlog therefore treats OpenShell’s broad software availability separately from future or hardware-dependent platform capabilities.