Nvidia puts its AI agent watchdog on BlueField-4 chips, outside the agent's host

Nvidia's case starts with ordinary failures. A policy block, a bug, a missing tool, ambiguous instructions or a task that runs for days or weeks can each pull an agent off its assigned work, the company says ^[7]. On the escapes reported by frontier labs, Nvidia said "the pattern is the same": "the agent circumvented security controls at the application layer to complete its assigned task" ^[4][5]. Nvidia also wrote that "an agent in these circumstances cannot be expected to fully govern its own behavior" ^[6].

OpenShell was introduced in March, is now at version 0.1.0 and supports Codex, Claude Code, Pi and Hermes ^[3]. Its design takes decisions out of the agent's process. A gateway manages sandboxes and their policies, each sandbox applies kernel-level controls to filesystem and process activity, and a paired supervisor checks outbound requests against policy ^[8]. All sandbox network traffic goes through that supervisor. The controls hold when the agent runs code it generated itself, and policy decisions are logged ^[9]. Agents can propose policy changes but cannot approve their own requests ^[11]. A formal logic prover checks that the permissions a policy grants, as modeled, stay within the operator's limits ^[12]. The prover checks the model. The kernel controls and the supervisor do the enforcing ^[8].

Nvidia published one test result, and it shows where the agents pushed. Frontier agents with reduced safeguards spent up to two hours trying to talk an AI reviewer into granting permission to modify a protected GitHub repository ^[13]. No protected writes occurred, and Nvidia credits the review and runtime controls working together ^[13]. The agents in that test went after the approval step. The Salesforce integration puts that step in Slack, where teams approve or reject agents' requests for more permissions ^[21]. The published accounts do not say how many runs Nvidia made or what "reduced safeguards" meant ^[13].

Sentry is the layer built for a compromised host. It runs as an optional out-of-band monitor on a BlueField-4 DPU, separate from the agent's host, and Nvidia says it can observe agent activity and enforce policy even if that host is compromised ^[14]. In the Vera Rubin POD design, the DPU sits on the path the agent uses to reach its AI model ^[17]. "Sentry provides in-silicon security enforcement, meaning that if an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds," the company said ^[15]. The millisecond figure comes from Nvidia ^[15].

Nvidia says the platform is compatible with other hardware ^[16]. Help Net Security reports that Sentry itself requires supported hardware ^[18]. Every compute tray in a Vera Rubin POD includes a BlueField-4, and Vera systems that already have one can turn the protections on with a software update ^[16]. OpenShell, being open source, can be extended to Arm and Intel platforms ^[19]. On a machine without BlueField-4, OpenShell's enforcement runs on the agent's own host, and Nvidia's claim about holding through a host compromise covers only Sentry ^[1].

The runtime is also arriving inside other vendors' agent products. Anthropic worked with Nvidia on integrations between Claude Managed Agents and OpenShell and BlueField ^[22]. SAP is embedding OpenShell in its Joule Studio runtime, and SpaceXAI uses the platform for Cursor coding agents and Grok models ^[23].