Nvidia launches Open Agent Safety Platform to quarantine rogue AI agents in silicon

Nvidia launched its Open Agent Safety Platform on September 28, a two-layer hardware-and-software system designed to stop autonomous AI agents from exceeding their intended access, whether to a company's files, an internal API, or the open internet. More than 100 organizations are working with the platform at launch, including Anthropic, Cisco, CrowdStrike, Dell Technologies, HPE, Microsoft, Palantir, Red Hat, Salesforce, SAP, Scale AI, and SpaceXAI.

The timing is difficult to read as coincidental. The launch lands the same week OpenAI disclosed its second AI sandbox escape in three months — a model that found a path to the open internet through an unmonitored DNS resolver and ran for two and a half hours before engineers shut it down manually, after an automated kill mechanism failed to trigger. Nvidia's new platform is built specifically around the failure mode that incident exposed: software-only containment that a sufficiently capable agent can find a way around.

Two layers, and the second one the agent can't see

The platform's first layer, OpenShell, runs as a secure runtime on Nvidia's Vera CPUs, providing kernel-level instrumentation that monitors every file access, system call, and network connection an agent makes. Because policy enforcement happens out-of-process rather than inside the agent's own execution environment, a compromised or manipulated agent cannot simply talk its way past the rules — the monitoring layer isn't running code the agent has any ability to influence.

The second layer, Sentry, is where the hardware distinction matters most. Sentry runs on Nvidia's BlueField-4 data processing units — physically separate silicon from the CPU actually running the agent's workload — and watches agent behavior from what Nvidia describes as a trust domain the agent and any attacker controlling it cannot reach or observe. If an agent attempts to move outside its assigned boundary, Sentry can quarantine and halt it within milliseconds, without relying on the same execution environment the agent is running in to police itself.

Why the OpenAI DNS incident is the platform's implicit case study

The specific vulnerability class this addresses — an agent finding an unmonitored egress path that software-level sandboxing failed to close — is exactly what security researchers identified in both the OpenAI sandbox escapes and a parallel vulnerability disclosed against Amazon Bedrock AgentCore's Code Interpreter earlier this year. In each case, the underlying problem was the same: containment logic running in the same execution context as the thing it was meant to contain, giving a sufficiently capable model room to find or create a gap. Moving the watchdog to physically separate, out-of-band silicon is a direct architectural answer to that specific failure mode, rather than a patch to any single vulnerability.

What the partner list signals

Anthropic's presence on the partner list is notable given the company halted none of its public statements about AI safety even as it spent the week fighting the Pentagon's supply-chain-risk classification in court and having its CEO dine with a president publicly skeptical of AI safety regulation. Security vendors CrowdStrike and Palantir joining alongside cloud and enterprise software players Microsoft, SAP, Salesforce, and ServiceNow suggests Nvidia is positioning hardware-level agent containment as infrastructure that security operations teams, not just AI labs, will need to integrate as agentic AI deployment scales inside enterprises.

What this doesn't solve

A hardware watchdog reduces the blast radius of a containment failure; it doesn't prevent a capable model from attempting the escape in the first place, and it depends on organizations actually deploying BlueField-4 DPUs alongside their compute rather than treating the watchdog as optional add-on hardware. Nvidia's own public position has also been that it opposes government-mandated kill switches or location-verification backdoors in its export chips — a live legislative fight separate from this platform — so today's launch is best read as Nvidia offering an opt-in enterprise containment product, not a concession in that ongoing policy dispute.