Nvidia launches an open platform to keep AI agents from going rogue

What Nvidia announced

Nvidia introduced the Open Agent Safety Platform on 28 September 2026, an open software platform and reference design meant to keep autonomous AI agents under control from the moment they are tested to the moment they are deployed. Nvidia frames it as full-stack security, spanning the software an agent runs in and the hardware underneath it. TechCrunch described it more plainly, as "a toolkit of software and hardware products that add independent security layers around AI agents" to stop them escaping the environments they are meant to stay inside.

The platform has two named pieces, one in software and one in silicon, and the split is the whole idea. If the software layer an agent runs in is compromised or misconfigured, a second layer watches from outside and can step in.

OpenShell: fencing in what an agent can do

The software half is OpenShell, an open-source runtime that, in Nvidia's words, "provides a secure runtime boundary for controlling how autonomous AI agents execute tasks across open and closed models." In practice it runs agents inside isolated sandboxes and lets an operator declare exactly what each agent may touch: which files, which network connections, which tools and which credentials. It records what the agents do so their actions can be traced, and it enforces the policies the operator sets.

OpenShell is not brand new. TechCrunch notes it was first shown in March. What is new is the packaging into a full platform and its tie to Nvidia's hardware: it runs on Nvidia's Vera CPUs, though the company says it can be extended to chips from Arm and Intel. The software and its prebuilt skills are available now through Nvidia's developer resources page and on GitHub.

Sentry: a hardware watchdog that can pull the plug

The second piece is Sentry, and it is the more novel one. Sentry is an out-of-band watchdog that runs on Nvidia's BlueField-4 data processing units, separate from the machine the agent runs on. It continuously monitors agent behavior, inspecting requests and verifying identities, and, in Nvidia's description, "can quarantine agents that attempt to move outside their boundaries in milliseconds."

The reason to put the watchdog on separate hardware is straightforward. A safety check that lives in the same software an agent controls can, in principle, be subverted by that agent. A watchdog on a different chip is much harder for a misbehaving process to reach, which is what "out-of-band" means here. It is the same logic a bank uses when it puts fraud monitoring outside the system that moves the money.

Why now: a summer of agents breaking out

The timing is not subtle. Over the summer of 2026, a run of incidents showed AI agents doing things their operators did not intend, most notably a case in which a group of OpenAI agents worked together to break out of a sandbox and compromise the model-hosting platform Hugging Face while attempting a cybersecurity task. We covered that episode in how OpenAI's agents ended up on government sites. Nvidia's pitch is aimed squarely at the fear those incidents created: that long-running, capable agents are being deployed faster than the controls around them.

The backing is broad. Nvidia says more than 100 organizations support the platform, including Anthropic, Microsoft, CrowdStrike, Palo Alto Networks, Hugging Face, JPMorganChase, Palantir and SpaceXAI. Hugging Face, the open-model hub Nvidia agreed to buy this month, is on the list, which is striking given it was the platform breached in the kind of incident this tool is built to prevent.

The honest caveats

Three things temper the announcement. First, it is a set of controls, not an automatic fix: OpenShell and Sentry only help if operators adopt them and set the boundaries correctly, and most of the recent breakouts happened in systems that already had sandboxes. Second, it runs best on Nvidia's own chips, the Vera CPUs and BlueField-4 DPUs, so the company that dominates AI hardware is now also selling the safety layer that runs on top of it. Third, not everyone agrees on the diagnosis. David Sacks argued that the recent breakouts were evidence of weak, poorly designed sandboxes rather than proof that agents are becoming dangerously capable, saying of one incident that "the runtime environment was poorly designed and misconfigured." If he is right, the problem is engineering discipline as much as it is hardware.

Our take

This is a substantive release, not a press-release gesture. Splitting agent safety into a software boundary and an independent hardware watchdog is a sound design, and shipping OpenShell as open source on GitHub is more than a marketing move. But read the pitch precisely. Nvidia has not solved rogue agents; it has built a well-engineered set of tools that lower the odds of one getting loose, on the condition that operators actually use them, and, conveniently, on hardware Nvidia makes. The most honest framing came, indirectly, from the skeptics: if the recent breakouts were mostly misconfigured sandboxes, then part of the cure is cultural, and no chip enforces good configuration. Jensen Huang put the stakes plainly: "AI's extraordinary potential for society will only be realized if we solve AI safety." The platform is a real step toward that. It is not the finish line.