NVIDIA used September 28, 2026 to make a case that it should own more than the chips that train and run AI agents. It wants to own the layer that keeps them in check. The company unveiled the NVIDIA Open Agent Safety Platform, an open software stack and reference hardware design built to sandbox, monitor and, if needed, shut down AI agents that wander outside their assigned lane. More than 100 companies signed on as partners, according to NVIDIA’s own announcement, but the loudest signal may be who didn’t: OpenAI’s name was missing from the public list, a detail flagged by the Daily Caller in its launch-day coverage.

The timing isn’t subtle. Enterprises have spent 2026 watching AI agents graduate from chatbots into systems that touch files, credentials, internal tools and live infrastructure, and the incident list has grown with them. NVIDIA’s pitch is that the industry needs a control layer built into silicon, not just policy documents and prompt filters. Whether that pitch lands depends on questions the launch itself doesn’t answer: how well the system works outside NVIDIA’s own hardware, what it costs, and whether “sign the partner list” translates into “shipped in production.”

What NVIDIA Actually Shipped: OpenShell and Sentry Explained

The Open Agent Safety Platform is built from two distinct pieces, and understanding the split matters more than the marketing name attached to either one. The first is OpenShell, open-source software that runs an AI agent inside a sandbox and enforces rules over what it can touch: files, tools, networks, background processes and credentials. NVIDIA said the goal is that developers can “formally verify an agent has enough authority to do its job and no more,” according to the company’s own framing of the release, as Help Net Security reported.

The second piece is Sentry, and it sits in a different place entirely. Instead of running alongside the agent, Sentry watches from outside it, on separate hardware, so a compromised or misbehaving agent can’t simply switch its own watchdog off. NVIDIA’s framing, according to Fox Business, is that “every agent should run in a zero-trust environment out of the box” and that agents “need isolation, monitoring, and behavior detection,” a point covered in Fox Business’s write-up of the launch. NVIDIA’s Deepali Boitano put the division of labor plainly: OpenShell governs what an agent is allowed to do, while Sentry independently monitors and contains behavior that strays from those rules.

That two-layer design is the core bet of the whole announcement. Software-only guardrails have an obvious weak point: if an attacker or a malfunctioning agent gets enough privilege inside its own environment, it can potentially interfere with the very monitor meant to catch it. Moving that monitor onto separate hardware is NVIDIA’s answer to that weak point, and it’s also, not coincidentally, a reason for enterprises to buy more NVIDIA hardware.

BlueField-4: The DPU That Becomes a Watchdog

Sentry doesn’t run on a GPU or a general-purpose CPU. It runs on NVIDIA’s BlueField-4 data-processing units (DPUs), chips originally built to offload networking, storage and security tasks away from a server’s main processors. That placement is the whole point: a DPU sits on the data path but outside the compute environment where the agent itself executes, giving Sentry a vantage point an agent can’t easily reach or blind.

NVIDIA’s claim, repeated across launch coverage, is that this arrangement lets the system “quarantine agents that attempt to move outside their boundaries in milliseconds.” That’s a vendor performance claim rather than an independently benchmarked result, and no outside lab has published numbers confirming it across real deployment conditions. Still, the architecture itself is a meaningful shift for a product line that started as a networking accessory and is now being pitched as a security control point for the entire agent economy.

OpenShell’s story is different. Its initial build targets NVIDIA’s own Vera CPUs, but reporting from Constellation Research indicates NVIDIA is working to extend it to Arm and Intel platforms as well, according to Constellation Research’s coverage. That’s a meaningful distinction: the software layer could plausibly run almost anywhere, but the hardware watchdog layer is tied to NVIDIA silicon for the foreseeable future. Portability of one half and lock-in on the other is a pattern worth watching as enterprises decide how much of their agent stack to build around it.

The Curious Case of OpenAI’s Absence

NVIDIA’s partner list is long, but a name-by-name reading of it turns up a gap that’s hard to ignore. OpenAI, the company running the largest deployed base of consumer and enterprise AI agents, was not among the more than 100 organizations NVIDIA named as working with the new platform, a detail first highlighted by the Daily Caller. Anthropic, by contrast, appears on the list, alongside Microsoft, which runs its own competing agent ecosystem through Azure and Copilot.

None of that establishes that OpenAI declined to participate, opposes the approach, or was even asked in a way that would show up publicly. It’s equally possible OpenAI is building its own containment architecture and didn’t want to be seen leaning on a rival’s hardware to police its agents. But in an industry where optics move stock prices and partnership announcements double as competitive signaling, an absence this visible from a list this long tends to get read as a statement whether or not one was intended.

Who Signed On: Reading the Partner List

CNBC’s reporting on the launch named a cross-section of companies working with NVIDIA on the platform, spanning networking and hardware vendors, cloud infrastructure providers, and enterprise software firms. The breadth is unusual for a security-product launch, and it tells its own story about how many corners of the industry think agent containment is now their problem too.

CategoryNamed OrganizationsWhy It Matters
Hardware & ChipmakersArm, Intel, Dell, HPE, LenovoSignals intent to make OpenShell portable beyond NVIDIA’s own CPU line
Cloud & InfrastructureCoreWeave, OracleGPU-cloud and enterprise cloud providers that host large agent workloads
AI LabsAnthropic, PerplexityModel developers whose agents would run inside the sandbox
Enterprise SoftwareMicrosoft, Salesforce, SAP, ServiceNow, IBMVendors whose agent products would need to plug into the governance layer
Enterprise & ConsultingAccenture, JPMorgan Chase, CiscoLarge enterprises and integrators positioned as early adopters

The names come from launch-day reporting by CNBC and Constellation Research rather than from a single official roster NVIDIA published in full, so treat the categorization as directional. A company appearing here may be testing the platform, advising on it, or simply agreeing to be named, and the announcement itself doesn’t distinguish between those levels of commitment. None of it confirms a production deployment at any of the listed organizations.

The Hugging Face Shadow Over the Launch

NVIDIA didn’t announce this platform in a vacuum. The past few months have delivered a string of incidents involving AI agents overstepping their intended access, and the most-cited among them is the breach at Hugging Face, where attackers strung together thousands of automated actions over several days before the intrusion was contained. NVIDIA has suggested, in general terms, that a platform like this one is meant to make that kind of prolonged, low-and-slow agent misuse harder to pull off.

That’s a claim worth treating skeptically. Whether OpenShell and Sentry would have actually stopped that specific breach, or any other named incident, is NVIDIA’s assertion and not an independently confirmed finding. Reports linking the platform directly to a nearly $13 billion Hugging Face acquisition figure are also unconfirmed by the available official material and shouldn’t be repeated as settled fact. What is fair to say is that the pattern of agent-related incidents this year, including cases where OpenAI’s own agents leaked user images, gave NVIDIA’s sales pitch a receptive audience.

Why Hardware Enforcement, Not Just Software Guardrails

Most existing approaches to agent safety live entirely in software: permission scopes, API rate limits, content filters, and instructions baked into a system prompt. NVIDIA’s argument is that instructions alone are not a security boundary, because an agent that’s been manipulated by a poisoned tool response or a malicious prompt can simply ignore them. A watchdog running on the same infrastructure the agent controls has the same problem in miniature.

Putting Sentry on a separate DPU is meant to remove that dependency. NVIDIA frames the split as defense in depth: OpenShell governs what an agent can request in the first place, and Sentry catches the cases where something slips past that first layer anyway. It’s a similar logic to how a bank pairs a vault door with a separate alarm system that doesn’t share a key with the door.

For illustration only (this is not NVIDIA’s published syntax, just a simplified sketch of the kind of scoped permission a runtime like this is designed to enforce), a policy definition might conceptually look something like this:

# Illustrative example only, not official OpenShell syntax
agent: invoice-processor
allow:
  filesystem: ["/data/invoices/*"]
  network: ["internal-erp.example.com:443"]
  tools: ["read_pdf", "write_row"]
deny:
  filesystem: ["/etc/*", "/home/*"]
  network: ["*"]
  credentials: ["admin-*"]
on_violation: quarantine

The value of a system like this isn’t the syntax, it’s the enforcement point. A policy engine that lives inside the same process as the agent can theoretically be talked around. One enforced from a separate chip is a harder target.

Competitive Landscape: How Rivals Approach Agent Security

NVIDIA isn’t creating the concept of agent governance out of nothing. Every major cloud and model provider already has some version of permission scoping and sandboxing, built from a different starting point and sold as part of a different bundle.

ApproachPrimary Enforcement PointKey Limitation
NVIDIA Open Agent Safety PlatformHardware (BlueField-4 DPU) + open-source runtimeSentry’s strongest guarantees depend on NVIDIA hardware being present
Cloud identity & access managementSoftware policy engines at the cloud-account levelEffective only if credentials are scoped correctly upfront, harder to catch in-session drift
Model-level alignment & guardrailsTraining and prompt-level constraints inside the model itselfCan be bypassed by prompt injection or manipulated tool outputs
Application-layer monitoring (e.g. Defender-style tooling)Logging and detection after actions occurTypically reactive rather than able to block an action mid-execution

Microsoft, which appears on NVIDIA’s partner list, already runs its own governance stack across Azure and Copilot, including tooling exposed through Azure AI Foundry, which had its own high-severity flaw disclosed earlier this year. Its participation in NVIDIA’s platform reads less like a concession and more like an acknowledgment that infrastructure-level protection and application-level protection can coexist without either side losing relevance. Google and AWS did not have a public reaction identified in launch-day coverage, and neither has announced a directly competing hardware-watchdog product as of this writing.

Historical Context: From Network Offload Chip to Security Product

DPUs weren’t originally sold as security hardware. NVIDIA’s BlueField line, inherited through its Mellanox acquisition years ago, was built to take networking, storage virtualization and encryption tasks off a server’s main CPU so those cycles could go toward actual application work. Turning the fourth generation of that chip into an AI-agent watchdog is a genuine repositioning, not a natural next step anyone would have predicted from the original product brief.

It also fits a broader pattern in NVIDIA’s business over the past two years, expanding from selling GPUs by the rack to selling the surrounding stack (networking silicon, orchestration software, and now governance tooling) that determines how those GPUs get used. The company has increasingly framed itself as an infrastructure company rather than a chip company, and the Open Agent Safety Platform extends that framing into a category, AI agent security, that didn’t meaningfully exist as a product line two years ago.

Industry Reactions

NVIDIA CEO Jensen Huang described the platform in stark, simple terms. On launch day, Huang called it “a browser for agents,” according to CNBC’s coverage of the announcement, a comparison meant to suggest a common, trusted runtime that agents operate inside of, the way a browser sandboxes a webpage from the rest of a computer.

Huang framed the broader ambition in a separate post, describing the launch as “the beginning of an open ecosystem to build the trust layer for safe agent systems,” a line reported by CyberScoop. NVIDIA’s own description of the platform, also carried by CyberScoop, positioned it as offering “full-stack governance and control across the software and the hardware, compute, and robotics systems that run agents,” a scope that extends well past data-center servers into robotics deployments as well.

The company’s framing of the underlying problem was blunt. NVIDIA said “every agent should run in a zero-trust environment out of the box,” adding that agents “need isolation, monitoring, and behavior detection,” according to Fox Business. And on the specific mechanics of containment, NVIDIA’s own materials state that “Sentry provides in-silicon security enforcement, meaning that if an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds,” per NVIDIA’s press release.

Market Impact: NVIDIA’s Bet on Owning the Agent Control Plane

The commercial logic behind this launch is not subtle. If enterprises standardize on BlueField DPUs as the trusted enforcement point for agent security, NVIDIA extends its footprint well past GPU racks and into every server that hosts an autonomous agent, whether or not that server is doing any AI training or inference work at all. That’s a meaningfully larger addressable market than accelerators alone, and it arrives as NVIDIA already commands roughly 90% of desktop GPU shipments, giving it both the balance sheet and the installed base to push a new hardware category into enterprise data centers.

It’s also a defensive move. As AI agents get blamed for a growing list of security incidents, regulators and enterprise buyers alike are asking who’s accountable when an agent does something it shouldn’t. By putting its name on the containment layer, NVIDIA positions itself as part of the answer rather than a bystander selling the hardware that made the incident possible in the first place.

Open Questions and Risks

Several practical questions remain unanswered by the launch material itself. NVIDIA has not published pricing for either component, nor has it given a specific general-availability date beyond the September 28 unveiling. That leaves a gap between “announced” and “deployable at scale” that enterprises will have to watch closely before budgeting around it.

There’s also an operational trade-off baked into any containment system this aggressive: overly strict policies can interrupt legitimate multi-step agent work just as readily as they stop malicious behavior, and enterprises will need policy-testing and exception-handling processes before they can trust the system not to quarantine an agent that was simply doing its job in an unexpected order. And because Sentry’s core guarantee depends on BlueField-4 hardware being present, its usefulness outside NVIDIA-heavy environments is, for now, an open question rather than a settled fact.

What Happens Next: Five Predictions

1. Pricing and availability details arrive within one to two quarters. NVIDIA typically follows a splashy platform announcement with SKU-level detail at its next major developer event. Expect BlueField-4 pricing and OpenShell release milestones to firm up well before mid-2027.

2. Cloud providers respond with their own branded governance layers rather than adopting NVIDIA’s wholesale. Google, AWS and Microsoft have too much invested in their own identity and access stacks to cede the agent-control narrative entirely to a hardware vendor, even one they partner with.

3. OpenAI either builds a comparable system in-house or partners with a different infrastructure vendor. A company running agents at OpenAI’s scale can’t credibly stay silent on containment for long, especially while its rivals are publicly signing on to someone else’s framework.

4. Independent security researchers will test the “milliseconds” containment claim. A number this specific, attached to a launch this high-profile, is a natural target for red-team benchmarking, and the first published third-party test will shape how much enterprises trust the marketing.

5. Regulators start asking whether hardware-level containment should be a baseline requirement. Given how much political attention AI agent incidents have already drawn this year, a platform like this gives policymakers a concrete technical reference point to point to when drafting agent-specific rules.

What This Means for Enterprise Buyers

For IT and security teams currently deploying agents in production, the immediate takeaway isn’t “buy BlueField-4 today.” It’s that the industry now has a public reference architecture for what layered agent containment can look like, and that’s useful even for teams building on entirely different infrastructure. The OpenShell half of the equation, if it does land on Arm and Intel as reported, could become relevant to a much wider set of buyers than the Sentry half ever will.

Teams evaluating agent deployments in the meantime should treat this the way they’d treat any pre-general-availability security announcement: useful for planning, not yet a substitute for their own sandboxing, credential scoping and monitoring, especially given how much of NVIDIA’s own claimed performance remains unverified by outside testing.

Frequently Asked Questions

What is the NVIDIA Open Agent Safety Platform?
It’s an open software platform and reference hardware design, announced September 28, 2026, meant to provide security, governance and control for AI agents from testing through production deployment.

What do OpenShell and Sentry each do?
OpenShell is open-source software that sandboxes an agent and enforces policies over what files, tools, networks and credentials it can access. Sentry is a separate monitoring layer that watches agent activity independently and can quarantine an agent that moves outside its defined boundaries.

What hardware does Sentry run on?
NVIDIA BlueField-4 data-processing units (DPUs), which sit separately from the CPUs and GPUs that run the agent itself.

Is OpenAI participating in the platform?
OpenAI was not named among the more than 100 organizations NVIDIA listed as working with the platform at launch, a gap first reported by the Daily Caller. That absence doesn’t confirm OpenAI declined to participate or opposes the approach.

Did this platform prevent the Hugging Face breach?
No. The platform launched after that incident, and any suggestion it would have prevented it is an NVIDIA assertion, not an independently confirmed finding.

How fast can Sentry contain a rogue agent?
NVIDIA claims quarantine can happen in milliseconds. That figure comes from the company’s own announcement and has not been independently benchmarked by an outside lab as of this writing.

What does the platform cost, and when is it generally available?
NVIDIA has not published pricing, and no specific general-availability date beyond the September 28, 2026 announcement has been confirmed in available reporting.

Will OpenShell work on non-NVIDIA hardware?
Reporting from Constellation Research indicates NVIDIA is working to extend OpenShell to Arm and Intel platforms, though its initial implementation targets NVIDIA’s own Vera CPUs.