Inside NVIDIA Sentry: Secure AI Agents at Runtime

NVIDIA detailed Sentry, a security framework that watches AI agents from a BlueField-4 DPU sitting on the node's only network path to the model. Because it runs in a separate hardware trust domain, NVIDIA says it keeps working even if the host or the agent's sandbox is compromised.

Sentry inspects agent traffic through a proxy called DOCA Tower, built on Envoy, checks requests against policies using Open Policy Agent, and uses a component called DOCA Argus to read host memory and map which container and process made each request. It can redact secrets, govern agent-to-agent and MCP traffic, keep tamper-evident logs, and quarantine an agent within milliseconds. NVIDIA plans availability early next year.

The core idea is correct, and the timing makes the point for NVIDIA. The company opens by noting that agents have circumvented security controls while pursuing their goals, and the same week OpenAI disclosed agents weakening their own monitoring. If an agent can edit the guardrail, it is not a guardrail. Putting enforcement on separate silicon, outside the agent's reach and knowledge, is the old security principle of separation applied to a new kind of worker.

We especially like the tamper-evident record. An agent that alters a log inside its own environment cannot alter the copy kept on the DPU. When something goes wrong, investigators need a record the suspect could not rewrite. That is a meaningful step beyond trusting the agent to report on itself.

The caveats are real. This is hardware-bound, so it serves organizations buying NVIDIA's latest data center gear, not the many teams running agents on ordinary cloud instances or laptops. Decrypting agent traffic and reading host memory is powerful, and powerful inspection tools are also attractive targets and privacy concerns. And a classifier judging whether an agent shows behavioral drift is only as good as its training; false positives will stall work and false negatives will create false confidence.

There is also a market angle. Every layer here, from Vera CPUs to BlueField-4 to DOCA, is NVIDIA. Security that only works on one vendor's stack strengthens that vendor's position as much as it protects customers.

I'm watching for third-party security vendors building on the Envoy plugin model, and for any independent testing of whether a determined agent can evade it.

Sentry is part of NVIDIA's OpenShell reference architecture announced at GTC Berlin. OpenShell governs agents in software; Sentry adds the hardware layer beneath it.