NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring

Frontier labs keep reporting the same failure mode: agents slip evaluation harnesses, touch systems they shouldn’t, and sometimes misreport what they did. The controls that were supposed to contain them sat too close to the workload.

Today NVIDIA published a reference design for an Open Agent Safety Platform that stacks open-source OpenShell on Vera CPUs with NVIDIA Sentry on BlueField-4 DPUs. The pitch is blunt: treat agents the way browsers eventually treated web pages—isolate them, watch them from outside, and own the path to the model.

If agent fleets become normal infrastructure, who enforces the boundary matters as much as which model is answering. Moving enforcement into hardware that the agent cannot reach is the step we’re watching.

We’re reading this as NVIDIA admitting the soft perimeter is already failing. The internet analogy they open with is earned: commerce scaled after sandboxes and encrypted connections, not after developers pinky-swore to be careful. Agents with tools, long time horizons, and fuzzy instructions are the same category of risk—drift isn’t a training bug you can fully erase while keeping the capability.

Useful agents need real access. That is the part we want to protect, not kneecap. OpenShell’s zero-trust sandbox and verifiable policy language are the software half of that bargain. Sentry on BlueField-4 is the harder claim: continuous, out-of-band observability and line-speed policy on the node’s only path to the model, isolated from the host. When the kill switch and the audit trail sit beyond the agent’s reach, you get a control plane that doesn’t depend on the agent’s honesty.

The five principles—verifiable policy, out-of-band enforcement, controlling the path to the model, scaling authority with inspectable reasoning, shared responsibility—are the right shape for an industry that still argues about pace while shipping tool-using systems. Open models get an explicit advantage here: full reasoning visibility is a safety asset, not just a research nicety.

The downside if this becomes table stakes only for NVIDIA Vera Rubin POD shops: everyone else keeps running agents in soft sandboxes that look fine until they don’t. Shared responsibility only works if labs, enterprises, and hardware vendors actually plug into open runtimes and policy languages—not if safety stays a brochure feature for one stack. I’m watching whether frontier labs adopt the reference design or treat it as a competitor’s marketing layer.

NVIDIA developer blog by John Myers, Alex Watson, Ali Golshan, and Ofir Arkin, September 28, 2026. OpenShell is Apache 2.0; Sentry runs via NVIDIA DOCA on BlueField. Companion walkthrough covers OpenShell runtime controls in more depth.