Nvidia moves AI agent security from software into the chip with OpenShell blueprint

Nvidia has published the OpenShell Reference Architecture, a full-stack design for running AI agents on company infrastructure. Its key feature is NVIDIA Sentry, software on BlueField-4 DPUs that Nvidia says can quarantine a misbehaving agent within milliseconds.

Nvidia announced the design on October 21 at GTC Berlin. It builds on OpenShell, the open-source secure runtime for agents that the company introduced earlier this year. The new material describes how that runtime fits together with Nvidia hardware, operating systems and security vendors. Nvidia says the architecture is available now.

Four layers, from sandbox to silicon

According to Nvidia’s developer blog, the software core has four parts. A gateway manages sandbox lifecycles and policies. A sandbox isolates the agent’s filesystem and process access. A supervisor, running outside the sandbox, checks outbound requests against policy and mediates credentials. A Policy Prover uses formal verification to test whether a policy stays within a ceiling the organization sets.

The blog also describes extension points: supervisor middleware that can inspect, block or modify network traffic to and from the agent, and gateway interceptors for deployment-specific rules. Identity, authorization, data protection and auditing systems can plug into these.

The hardware layer is optional. Vera CPUs run the agent harnesses and tool calls, while Vera Rubin NVL72 systems handle inference, including Nemotron models. BlueField-4 DPUs sit in the I/O path between agents and the models they call. Sentry runs there, in a separate trust domain, watching requests, responses, network and file activity, checking identity and delegated authority, and analyzing selected host memory for deviations. Nvidia says violations are enforced in silicon and that the setup can raise agent capacity by up to 20%.

The blog’s premise is blunt: “An agent cannot govern itself.” Jensen Huang, Nvidia’s founder and CEO, framed the launch in the press release: “AI capability and safety must advance together.”

Numbers Nvidia and CoreWeave put on Vera

Nvidia lists Vera with 88 Olympus cores, 96 lanes of PCIe Gen 6 and up to 1.2 TB/s of LPDDR5X memory bandwidth. It claims up to 2x the performance and performance per watt of x86 CPUs on agentic workloads, and 30x higher throughput per megawatt for Vera Rubin on such workloads.

The only third-party figures come from CoreWeave, which tested Vera against an unnamed leading x86 CPU. It reported sandbox startup more than 3x faster, more than 11,000 concurrent agent environments per rack, and agentic loops finishing 1.8x faster on average across 20 Terminal Bench tasks, with gains of up to 2x on some. These are vendor and partner results, and the x86 comparison chip is not named.

A partner list that spans rivals

Nvidia names model builders including Anthropic, Cohere, Google, Meta, OpenAI and Perplexity. Security partners include CrowdStrike, Palo Alto Networks, Okta, Zscaler and Microsoft. Cloud and system partners range from CoreWeave, Nebius and Oracle Cloud Infrastructure to Dell, HPE, Lenovo and Supermicro. The software runs on Canonical, SUSE and Red Hat platforms, and on Windows through Microsoft Execution Containers. BBVA and Santander are exploring it, and Palantir is working with customers on production deployments.

Two product tie-ins stand out. SAP is integrating OpenShell with its Joule Studio runtime. ServiceNow announced general availability of ServiceNow Arc, a long-running personal agent whose actions are governed by its Control Tower and enforced by OpenShell.

Why putting enforcement outside the agent is a real shift

The technical idea is separation of duties. Most agent guardrails run in the same software stack as the agent, so a compromised or confused agent can in principle tamper with them. OpenShell already moved checks into a supervisor outside the sandbox. Sentry goes further by moving observation onto a different processor, which the agent cannot reach, and by looking at memory directly instead of relying on what the agent reports about itself.

That builds on a product with a short history. Nvidia first showed OpenShell at GTC on March 16, 2026, alongside NemoClaw, a toolkit for running OpenClaw agents. CIO reported then that NemoClaw was an early-access preview that Nvidia described as alpha-stage. Nvidia’s own earlier post described policies covering the filesystem, network and process layers, with an audit trail of allow and deny decisions. The new announcement is the attempt to make that prototype into something a bank can deploy on dedicated hardware.

The hardware route also ties safety to Nvidia silicon, even though OpenShell itself is open source and the sandbox layers can run without BlueField-4. It fits the company’s broader push to sell whole systems, as with its DSX POD for AI factories.

What the announcement leaves open

OpenShell is on GitHub, and a Secure Agent Workspace Reference Design is published in Nvidia’s documentation. The sources give no dates or prices for Vera, BlueField-4 or Sentry, so it is unclear when the hardware layer can be bought. Nvidia has not published independent tests of the claim that Sentry stops an agent within milliseconds, or of how often it flags legitimate behavior. The partner list shows participation, not that each company ships OpenShell in production; only a few, such as ServiceNow, are described as live.