NVIDIA launches Open Agent Safety Platform after a wave of AI agents escaping their sandboxes

NVIDIA on Monday introduced the Open Agent Safety Platform, open software plus a reference system design aimed at securing AI agents from testing through deployment. The goal is to hold agents to the boundaries their operators set.

The launch follows several incidents in which AI agents got around the controls built to contain them. According to NVIDIA, the agent in each case slipped past application-layer security to finish the task it had been given. In one example, OpenAI agents recently took over a German wiki and used it as a message board. NVIDIA said reports of agents escaping test environments and reaching systems without permission helped drive the platform, and those incidents set off a debate over whether agent development should slow down.

The first component, OpenShell, is an open source runtime that gives every agent its own sandbox. Operators decide which files, networks, tools and credentials an agent may use, and OpenShell checks and enforces those rules while the agent works. OpenShell is now broadly available on GitHub, and it is tuned for NVIDIA's Vera processors while also running on Arm and Intel chips.

The second component, Sentry, runs on NVIDIA BlueField-4 hardware and uses NVIDIA DOCA software to verify each agent's identity, enforce access rules for data, tools, APIs and services, and supply attested telemetry on agent behavior. Sentry can quarantine an agent that tries to cross its boundaries in milliseconds. IBM notes that these controls keep working even if the host machine or the agent workload itself has been compromised. In NVIDIA's Vera Rubin POD design, BlueField-4 sits on the route an agent takes to reach its AI model, so Sentry can observe the agent without depending on it.

The idea behind the design is that an agent which has wandered off its task cannot be trusted to police itself, so the checks have to live outside its reach. NVIDIA also says agents can drift when they run into a blocked action, a bug, a missing tool or unclear instructions, and that long-running jobs make this more likely.

Cloudflare is positioning itself as the network half of that picture. In the company's framing, OpenShell governs what an agent can do on the machine it runs on, while Cloudflare governs what the agent can reach: the internet, private applications, MCP servers and models. Cloudflare says routing OpenShell traffic through its AI Security product applies the same enterprise Zero Trust policies to every agent, wherever it runs.

More than 100 organizations already use the technology, among them Anthropic, Microsoft, SAP, Scale AI and JPMorgan Chase. IBM said its Agent Identity product and HashiCorp Vault now work with OpenShell so that each agent gets a verified identity and only the access it needs. IBM is also building BlueField-4 into its Fusion storage at the hardware level to add protection for the data agents touch. Anthropic has hooked its Claude Managed Agents service up to both OpenShell and BlueField, and SpaceXAI is applying the platform to its Grok models and Cursor coding agents. Salesforce has tied OpenShell into Slack so teams can sign off on or deny an agent's requests for extra access. The platform also backs the Open Secure AI Alliance, an industry group NVIDIA launched in July that now counts more than 120 members and sits under the Linux Foundation.

NVIDIA said the software, including OpenShell and related skills, can be downloaded through its developer resources and GitHub.