Nvidia wants to become the infrastructure beneath enterprise AI agents, not only the company supplying the chips on which they run.
The open-source Agent Toolkit, announced at GTC 2026, combines a secure runtime, open models and an agentic research blueprint. Its target is the obstacle slowing production deployment: organisations want agents to act across internal systems but lack a standard way to control data access, policies, cost and liability.
The partner list spans enterprise software, security, engineering and healthcare, suggesting Nvidia is building a common layer rather than a single application.
OpenShell gives autonomous software a boundary
The toolkit’s centrepiece is OpenShell, an open-source runtime that enforces policy-based security and privacy controls. Nvidia calls individual agents “claws”; OpenShell defines the environment in which each one can act.
That boundary is necessary because an agent able to use tools is more consequential than a chatbot generating text. It may access files, change records or trigger workflows. Policies need to state which resources are available, which actions are prohibited and what evidence is retained.
Nvidia is working with Cisco, CrowdStrike, Google, Microsoft Security and TrendAI to integrate OpenShell with existing security products. This acknowledges that agent controls cannot become a separate island. Enterprises already monitor identities, endpoints and threats through established systems.
The runtime does not remove liability, but it can make behaviour more inspectable. Security teams gain a defined enforcement point instead of relying on every agent developer to implement safeguards independently.
AI-Q separates orchestration from research
Nvidia AI-Q, built with LangChain, uses frontier models to orchestrate work and open Nemotron models for research-heavy steps. Nvidia claims the hybrid architecture cuts query cost by more than 50% while leading two DeepResearch Bench leaderboards.
The economic principle is sensible even when benchmark claims require real-world validation. Expensive models need not perform every subtask. Routing repetitive research to a capable lower-cost model can protect budgets as usage grows.
Consumption pricing often looks manageable in pilots because volumes are small. A research agent serving thousands of employees can generate long contexts and many tool calls. Architecture determines whether that scale creates value or an uncontrolled bill.
The toolkit is available across AWS, Google Cloud, Microsoft Azure and Oracle Cloud Infrastructure. Open deployment reduces pressure to adopt one hosting environment while allowing Nvidia’s software layer to remain common.
Enterprise partners turn components into workflows
Salesforce is developing a reference architecture in which Slack orchestrates Agentforce agents across cloud and on-premises data. Atlassian is connecting the toolkit to Rovo in Jira and Confluence, while ServiceNow uses AI-Q in its autonomous specialist strategy.
Siemens’ Fuse EDA agent applies Nemotron to electronic design workflows from conception to manufacturing sign-off. IQVIA says it has already deployed more than 150 agents internally and with clients, including 19 of the world’s 20 largest pharmaceutical companies.
These examples show why a toolkit matters. Each industry needs different tools and policies, but identity, containment, model routing and monitoring recur across deployments.
Nvidia is positioning OpenShell, Nemotron and AI-Q as the agent equivalent of an infrastructure stack. The company benefits whether the visible application comes from Salesforce, Atlassian, Siemens or an internal team.
The open-source strategy may encourage adoption, but enterprises still need to test how policies hold under failure, malicious instructions and integration complexity. A framework is only as strong as its configuration and operational discipline.
The Agent Toolkit’s significance is therefore not that it makes autonomy safe by default. It gives companies a shared place to express control. If agents become a normal workforce layer, that enforcement point could be as important as the models doing the work.
Production trust will ultimately depend on whether those controls remain understandable when many vendors and hundreds of agents share the same environment.