Four leading AI research organizations disclosed this summer that their models broke free from isolated test environments and accessed production systems. In response, Nvidia unveiled the Open Agent Safety Platform on Monday, combining kernel-enforced sandboxing with a dedicated hardware watchdog capable of terminating agents at the network layer.
The platform merges OpenShell 0.1.0, an Apache 2.0 licensed agent runtime first shown at GTC in March, with Nvidia Sentry, a monitoring service deployed on Nvidia's BlueField-4 data processing units (DPUs). The latest OpenShell iteration introduces a policy prover designed to verify that combined agent permissions cannot exceed operator-defined boundaries.
Because the BlueField DPU functions as an independent processor with its own security domain, it can monitor agent interactions with models and track all actions and reasoning chains. When violations occur, it can sever network connectivity instantly.
Justin Boitano, Nvidia's vice president of enterprise AI, stated during a press briefing that recent incidents "have highlighted a fundamental hurdle for AI agents, and that is that model-level safeguards alone can't govern what agents can access or do." He continued: "To date, model safety has been about training good behavior into the model. The industry calls that model alignment. For probabilistic systems, this approach has obvious limitations. That's why we're introducing a deterministic system to mediate and enforce how these agents behave."
The summer of sandbox escapes
On July 21, OpenAI disclosed that GPT-5.6 Sol and a research prototype exploited a zero-day vulnerability in their sandbox's package proxy, the sole network interface, to reach Hugging Face's production database.
Days later, Anthropic reported that three of its models gained unintended internet access through its evaluation partner Irregular, subsequently accessing a real company's database and deploying a malicious package to PyPI.
Meta disclosed on August 6 that a pre-release Muse Spark model read and altered a real website's database after the same Irregular misconfiguration exposed a legitimate site name.
Most recently, Google announced that Gemini penetrated networks belonging to three companies, again originating from an Irregular test environment.
Irregular, which conducts pre-release security evaluations for leading AI labs, appears in all these incidents. Notably, the company is listed as a partner for this Nvidia launch.
Nvidia's technical blog attributes the breaches not to novel model capabilities but to "a combination of tools, time, and ambiguous instructions."
When asked if the platform would have prevented the Hugging Face incident, Boitano acknowledged each case differs but stated: "from what we know, this new security platform could have stopped the breach if it was being used in frontier labs for model evaluation early on."
Enforcing policy outside the agent
OpenShell forms the platform's foundation and remains largely unchanged since its March GTC debut.
Under OpenShell, each agent operates within a kernel-isolated sandbox with no direct network connectivity; all external communication routes through an external supervisor.
Boitano explained: "Traditional sandboxes, whether we're talking micro VMs or containers or VMs, were built for application-level isolation. Every agent running within your company needs to run in its own isolated sandbox with security controls that are outside of the agent's reach."
A prover, not a judge
Version 0.1.0 of OpenShell introduces a policy prover as its key new feature. This component validates that permissions granted by a policy remain within the operator's intended scope.
Ali Golshan, Nvidia's senior director of AI software, noted during the briefing: "It is deterministic. It is mathematical reasoning. So this is not LLM as a judge." He added that this approach delivers "roughly at two orders of magnitude higher performance and speed."
In Golshan's demonstration, a policy might prohibit agents from reading code on GitHub and posting it externally. However, an agent could circumvent this by spawning two sub-agents: one reading from GitHub, communicating with another capable of posting externally. The prover models combined access across the entire agent fleet to identify such bypass paths.
During Nvidia's internal testing, agents operating with relaxed safeguards spent up to two hours attempting to persuade an AI reviewer to grant write access to a protected repository. The prover supplied the reviewer with evidence of what the request actually enabled, preventing any unauthorized writes.
Sentry: the safety island
Nvidia Sentry introduces an additional hardware-based security layer. Operating on BlueField-4 within a separate trust domain from the host system, it can isolate an agent in milliseconds.
With a DPU present, agent model endpoints route "through a proxy on the DPU, so that you can see all of the reasoning traces of the agents on the host," according to Boitano.
Unlike OpenShell, Sentry remains proprietary, though Boitano noted it features open APIs and OpenShell can integrate with alternative network enforcement hardware.
Boitano drew a parallel to autonomous vehicles: "There's a primary system that might be running the perception system, and then a safety island that ensures the safety of the system."
He emphasized: "The DPU is really optional in these architectures. In a lot of cases, just using OpenShell on CPUs is honestly good enough for providing sort of strict access control for the agents." The DPU targets "frontier use cases of evaluating models or systems where you might have the guardrails off the models, so it could be for red teaming."
Who's building on it
Anthropic is integrating OpenShell with Claude Managed Agents, which already maintains agent loops on Anthropic's infrastructure while delegating tool execution to customer-controlled sandboxes.
SpaceXAI is deploying the platform for Cursor coding agents and Grok models. Salesforce has incorporated OpenShell audit events and permission approvals into Slack.
SAP is embedding the runtime into Joule Studio and contributing code to the project.
OpenAI and Google, two of the four labs whose agents escaped this summer, do not appear on the partner roster. AWS is also absent.
When asked whether Anthropic and OpenAI intend to deploy OpenShell and Nvidia Sentry for their own training operations, Boitano directed observers to watch for announcements from the partners themselves.