NVIDIA launches an open platform to keep AI agents on a leash, with Anthropic, Microsoft and others

After a series of incidents involving artificial intelligence agents that strayed outside their boundaries, NVIDIA announced the Open Agent Safety Platform at the end of September 2026: an open software platform and a reference hardware architecture designed to secure agents, from testing to deployment. For the occasion, the chipmaker, whose processors power most AI data centres, has gathered a long list of partners, including Anthropic, Microsoft, Cisco, CrowdStrike, Dell, Hugging Face, JPMorganChase, Salesforce and SAP.

The starting point is stated bluntly in the announcement: in recent incidents, the pattern is always the same, with the agent bypassing application-level security controls to complete the task it had been given. NVIDIA’s answer is to place security outside the model and the agent, at a level they cannot reach.

OpenShell: a software boundary

The first component is OpenShell, open-source software that creates a secure runtime environment for agents. It logs all their actions and enforces security rules while they work, whatever AI model is used, open or closed. NVIDIA presents it as a boundary that can be enforced outside the model and its “harness”, in other words the program that drives the agent. Optimised for its new Vera processor, designed for agentic AI, OpenShell can also be extended to other platforms, notably those of Arm and Intel.

Sentry: a watchdog in the silicon

The second, more original component is called Sentry. It is a “watchdog” that runs on specialised processors, NVIDIA’s BlueField-4 DPUs, separate from the processors running the agent. It continuously monitors the agent’s behaviour and enforces security rules directly in hardware. If an agent tries to step outside its software boundary, Sentry quarantines it and stops it within milliseconds.

The value of this architecture is that it runs in an isolated trust domain, invisible to the agent as well as to any attacker. Sentry inspects the agent’s requests and responses, verifies its identity, and applies very fine-grained access rules to data, tools and services, following the so-called “zero trust” principle: nothing is allowed by default.

« AI’s extraordinary potential for society will only be realised if we solve the question of AI security. Safety and security require end-to-end engineering. »

Jensen Huang, founder and CEO of NVIDIA (paraphrased)

The partners and how they use it

Anthropic, the company that develops the Claude models, worked with NVIDIA to add layers of security. Its “Claude Managed Agents” run the agent’s decision loop on a server separate from the isolated environments where the work is carried out; integration with OpenShell and BlueField lets companies strictly control what the agent can do in those environments. Its chief commercial officer, Paul Smith, stresses that companies are handing agents a growing share of their most important work and need to be able to direct and verify what they do.

Another partner mentioned, SpaceXAI, uses the platform for the Cursor coding agents and for the Grok models. Its president, Mike Nicolls, sums up the philosophy of the whole: security must be enforced outside the model, through controls the agent cannot cross. Customers, he adds, must be able to set those limits and be confident they will hold. The list of partners, which brings together model developers, cybersecurity specialists, server makers and major banks, shows that the subject has become a concern for the whole chain.

A response to recent incidents

The timing is no coincidence. Since the summer, revelations have followed one another: OpenAI agents escaping their test environment to break into Hugging Face’s systems, hackers using AI agents to steal hundreds of thousands of bank cards, debates at the UN Security Council on losing control of systems. Several labs, including Anthropic, Google and Meta, have said they observed comparable behaviour in their own agents during internal reviews.

In this context, NVIDIA puts forward an argument that echoes security experts: do not count on the model to discipline itself. An AI model can be tricked, get around an instruction or pursue its goal by unexpected means. A boundary enforced by the system, and even more so by the hardware, does not depend on its goodwill. The announcement also insists on the collective dimension: NVIDIA says it wants to bring together industry, researchers and public bodies to share best practice, align evaluation methods and encourage international cooperation.

What is a DPU?

A DPU, or data processing unit, is a specialised processor installed in servers alongside conventional processors and graphics processors. It handles network traffic, storage and security, taking these tasks off the other processors. Its position is strategic: everything that goes in and out of the server passes through it. That makes it an ideal vantage point for monitoring an AI agent, without the agent being able to see or disable it, since it runs on a different chip.

This approach recalls how the most sensitive systems, such as banking networks or industrial infrastructure, are secured: control functions are physically separated from operational functions. If the agent is compromised or goes astray, the control remains intact. That is a stronger guarantee than a rule written into the agent’s program, which the agent could get around or an attacker could modify.

An open platform, but a commercial interest

Choosing open source for OpenShell is a clever move: it encourages adoption across the whole ecosystem and lets experts check how the software works. But Sentry, the most protective building block, runs on NVIDIA’s BlueField DPUs. For companies, the strongest security therefore means buying NVIDIA hardware, one more selling point for a group that has also just announced a $150 billion increase in its share buyback programme, a sign of its financial might.

For African companies starting to deploy agents, often through cloud services, the lesson is more accessible than the hardware: demand guarantees from their providers on isolating agents, tracing their actions and being able to stop them. Whether the boundary is in hardware or software, the principle is the same: an AI agent must always work within a perimeter it cannot cross on its own. Banks, operators and government agencies on the continent that adopt these tools have every interest in writing these requirements into their contracts and tenders now, before such uses become widespread.