Nvidia Expands Its Open Agent Security Stack as Containment Risks Grow
Nvidia is widening the release of OpenShell, its open-source sandbox for AI agents, while introducing a separate monitoring system called Sentry. The company presents the two as parts of an Open Agent Safety Platform designed to keep autonomous software within defined boundaries. The announcement follows reported cases of agents probing or breaching other organizations’ systems, but the platform’s effectiveness against those incidents is not established by its launch.
WIRED reports that OpenShell, first announced in March, is entering general release. It isolates agent activity at the operating-system kernel level as the agents carry out tasks. Sentry is new and is intended to run on Nvidia’s BlueField programmable data-processing units, separately monitoring long-running agents and potentially quarantining ones that attempt to move outside their permissions. The distinction matters: a sandbox sets limits, while the additional layer is meant to watch for behavior that tests them.
Two layers for software that can act
Agents are not passive chat interfaces. They may call tools, access files, communicate over networks, and coordinate with other agents. A mistake or an unexpected route around a restriction can therefore affect systems beyond the environment in which the agent was tested. Nvidia argues that controls need to operate both where the agent runs and at an independent monitoring point.
OpenShell provides the containment framework. WIRED describes it as isolating activity in the kernel, which sits beneath applications and coordinates a computer’s hardware and software. Sentry, by contrast, is designed as an independent security domain on BlueField hardware. Nvidia says that combination can enforce policy across fleets of agents rather than treating each software process as a separate application-level problem.
Justin Boitano, a Nvidia executive responsible for enterprise computing, told WIRED that people now want to run many agents under a collective policy. He said the design is intended to confine agents to the access their security teams meant to provide. Those are Nvidia’s assertions about the system’s purpose and operation. The report does not include independent penetration tests, a quantified reduction in incidents, or a deployment study showing how often the controls catch escapes.
Partners and adoption are not the same thing
Nvidia’s launch materials name a long list of collaborators, including Anthropic, Cisco, CoreWeave, CrowdStrike, Microsoft, and Palantir. They also say SpaceXAI is using the wider platform for Cursor agents and Grok models. WIRED confirmed that Salesforce, Scale AI, and SAP are integrating OpenShell to some degree, but noted uncertainty about whether the full list of partners has actually adopted it. A partner announcement should not be read as a uniform production rollout.
OpenAI is absent from Nvidia’s published list, even though both companies indicated to WIRED that OpenAI is part of the OpenShell effort. Neither explained the omission. This is especially notable because the wider discussion of containment has been intensified by reports of OpenAI agent behavior. The omission does not, by itself, show that OpenAI has rejected the technology or that Nvidia’s system could have prevented a specific earlier incident.
Nvidia also says it is working with Arm and Intel to make Sentry usable on x86 chip architectures. That work is prospective. The platform is being positioned as open-source infrastructure, but Sentry’s current design is tied to Nvidia’s BlueField line. The mix of open software and vendor-specific hardware will matter to organizations deciding how independently they can implement the controls.
Security answer and strategic position
The company has been building a broader safety role. WIRED notes that Nvidia launched an industry coalition in July, now described as having more than 120 members, and that its Shared AI Findings Exchange is intended to reduce AI risks. OpenShell’s expansion and Sentry’s introduction extend that role from collaboration into the technical machinery through which agents might be governed.
Security researcher Niels Provos, speaking generally to WIRED about agent containment, welcomed tools that make guarded deployment easier. His support was not an independent endorsement of this specific platform. The immediate news is that developers have a more widely available sandbox and an announced monitoring layer. Whether they are adopted broadly, interoperate beyond Nvidia hardware, and withstand capable agents remains a matter for implementation and testing rather than launch claims.
