NVIDIA released the Open AgentAI agentAn AI program that performs work steps by itself, for example reading a message, drafting a reply, and recording the result.Open the glossary Safety Platform on September 28, 2026, to control AI-agent actions from the runtime layer to hardware. For operational teams, the main change is not a smarter model. It is a control layer that remains active when an agent misreads an instruction, requests forbidden access, or moves outside policy.
An agent safety runtime is an execution environment that keeps file, process, network, APIAPIThe official door 2 systems use to exchange data, without anybody copying it by hand.Open the glossary, and credential permissions outside the model's decision. The model can propose an action, but the runtime decides whether the action can run.
What changed in AI-agent security?
In its official announcement on September 28, 2026, NVIDIA introduced an open design with two main layers. OpenShell is an open-source runtime, and Sentry is a separate watchdog. OpenShell traces agent actions and enforces policy while an agent runs. Sentry monitors activity from an NVIDIA BlueField-4 DPU and can quarantine an agent that crosses a boundary in milliseconds.
This distinction matters because a prompt guardrail is not an access control. A prompt can tell an agent not to read a secret folder, but a filesystem policy can block that read. An instruction can tell the agent to contact only one API, but a network policy can deny every other connection.
| Layer | Control | Operational effect |
|---|---|---|
| OpenShell | Files, system calls, networks, and credentials | Reduces the blast radius of bad inputs or agent errors |
| Sentry | Independent monitoring and enforcement on BlueField-4 | Adds control outside the agent process |
| Policy | Declarative permissions for each workload | Can be reviewed, tested, and audited as configuration |
Who needs to act?
Engineering teams that run coding, browser, customer-service, or automation agents should evaluate this approach first. On September 29, 2026, the OpenShell documentation listed secure coding-agent use cases for ClaudeClaude ProThe paid subscription for the Claude AI assistant from Anthropic. It unlocks connectors to outside tools.Open the glossary Code, OpenCode, Codex, and GitHub Copilot CLI in sandboxes with constrained file and network access.
Security and compliance teams also need to act because agent policy becomes a reviewable artifact. The official OpenShell documentation describes controls for filesystems, networks, processes, and provider credentials. The agent does not need to see a real credential. The runtime can add it only to a request for an approved endpoint.
Sentry is not an initial requirement for every company. Sentry uses BlueField-4 for enforcement outside the process. A small team can begin with OpenShell sandboxes and policies. An organization with sensitive workloads can then assess the extra hardware layer.
How does this affect cost and team workflow?
The new cost is not limited to compute. Teams must budget time to write policy, test blocked workflows, process access requests, store audit events, and maintain sandbox images. These controls can also reduce incident costs, such as leaked credentials, source code sent to the wrong host, or commands that run outside scope.
For measurement, do not stop at “the agent completed the task.” Track denied actions, access requests, outbound connections, policy changes, approval time, and failures caused by policies that are too narrow. These metrics complement chaos engineering for AI-based development workflows and reviews of command-execution risks in desktop agents.
What should an operational team do now?
- Map real access. List the folders, domains, APIs, commands, and credentials for each agent.
- Separate agents by task. Do not use one broad sandbox for coding, support, and deployment.
- Start with deny by default. Allow a host or path only when the workflow needs it.
- Test hostile inputs. Give the agent a document or page that attempts to redirect it, and verify that the runtime blocks actions outside policy.
- Measure blocks and false positives. Record each denied action, its reason, and recovery time.
- Run a non-production pilot. Compare task completion, task time, and approval count before moving sensitive workloads.
OpenShell is available under the Apache 2.0 license in NVIDIA's official repository. On September 28, 2026, NVIDIA also said that OpenShell can be extended to third-party compute platforms, including Arm and Intel. The design therefore reaches beyond one hardware stack, but teams must still test compatibility in their own environment.
Frequently asked questions
Does OpenShell replace prompt guardrails?
No. A prompt guides model behavior. OpenShell enforces file, process, network, and credential boundaries when an action runs.
Must a team buy BlueField-4?
Not to start with OpenShell. BlueField-4 is required for the separate Sentry layer, not for every OpenShell runtime use case.
Does a sandbox make an agent safe by default?
No. A broad policy still creates risk. Teams must test policy, dependencies, images, endpoints, and approval paths.
Is this relevant to a company that does not use agents yet?
Yes, as a procurement checklist. Ask a vendor where enforcement runs, how it handles credentials, what it logs, how it isolates workloads, and how it revokes access.
Operational conclusion
NVIDIA's September 28, 2026 release moves the discussion from “can the agent work?” to “which boundaries remain active while it works?”. Select one non-production workflow, write its minimum permissions, run it in a sandbox, and measure denied actions, completion rate, approval time, and cost per task before you expand access.
