Technology · NEWS EXPLAINER
NVIDIA AI Agent Safety Platform Adds OpenShell and BlueField Sentry
NVIDIA’s September 28 platform combines the open-source OpenShell runtime with a Sentry reference design on BlueField-4 DPUs, adding a separate enforcement layer for autonomous agents while leaving real-world effectiveness to be proven in deployment.
NVIDIA on September 28 introduced its Open Agent Safety Platform, a new control architecture for autonomous AI agents. The platform combines OpenShell, an open-source runtime that restricts what an agent can execute and access, with Sentry, a separate reference design that runs on BlueField-4 data processing units to watch activity outside the agent’s host environment.
The important distinction is where those controls live. OpenShell can be used without Sentry and can extend beyond NVIDIA CPUs, while Sentry adds a hardware-isolated monitoring and enforcement layer. NVIDIA says that layer can quarantine boundary violations in milliseconds, but independent reporting notes the platform has not yet been broadly proven in real-world deployments.
OpenShell sets a software boundary around the agent
OpenShell is the software half of the launch. NVIDIA describes it as an open-source runtime that separates agent execution from access to files, credentials, services and outside systems. Its Sandbox and Supervisor components enforce policy outside the agent process rather than relying only on prompts or the agent framework to behave correctly.
The September 28 technical release identifies OpenShell 0.1.0 as broadly available and says it can support agents including Codex, Claude Code, Pi and Hermes. NVIDIA also says the software can be extended to non-NVIDIA compute, including Arm and Intel platforms, so the runtime boundary is not inherently tied to BlueField hardware.
Sentry moves a second enforcement layer outside the host
Sentry is different from OpenShell. It is a reference system design built around BlueField-4 DPUs and NVIDIA DOCA, intended to observe agent traffic and enforce policy from a separate trust domain. NVIDIA says that separation lets Sentry verify identity, inspect requests and responses, protect access to data and tools, and continue enforcing rules even if the host workload is compromised.
NVIDIA says Sentry can quarantine an agent that moves outside its boundary in milliseconds. That latency and the broader security benefit are vendor claims at launch, not independent performance results. The architecture matters even without accepting the benchmark claim: the watchdog is designed to sit outside the agent and host software that it is supervising.
For operators, the practical question is which layer enforces each permission
The launch is most useful as a map of control points. OpenShell can restrict an agent’s filesystem, processes, credentials, network destinations and tool access at runtime. Sentry adds a separate observation and enforcement domain on systems equipped with BlueField-4. Those are complementary layers, not interchangeable product names.
NVIDIA lists more than 100 organizations working with the platform technologies and names integrations with companies including Anthropic, Salesforce, SAP, CrowdStrike, Palo Alto Networks and Cisco. That ecosystem is evidence of vendor and partner activity, not proof that the design has already prevented failures at scale. TechTarget specifically notes that the platform is new and has not yet been broadly proven.
