Nvidia on Monday announced the Open Agent Safety Platform, which combines open source software and a reference system design to keep AI agents within set boundaries from testing through deployment.
The platform has two main parts. One of them is OpenShell, an open source runtime that sandboxes agents and enforces policy on what they do. The second is Sentry, a watchdog that runs separately on Nvidia’s BlueField-4 data processing units (DPUs).
Nvidia introduced OpenShell in March. The runtime, now at version 0.1.0, is broadly available. It supports agents such as Codex, Claude Code, Pi and Hermes.
Nvidia is pitching the platform against a backdrop of recent incidents in which frontier AI labs have reported agents escaping the evaluation environments meant to contain them, reaching systems they should not have accessed and, in some cases, misreporting what they did.
“Across these incidents, the pattern is the same — the agent circumvented security controls at the application layer to complete its assigned task,” Nvidia said.
The company says agents can drift from their intended task because of a policy block, a bug or a missing tool. Drift can also happen when instructions are ambiguous or when agents run for days or weeks on hard problems. “And here’s the most important lesson: an agent in these circumstances cannot be expected to fully govern its own behavior,” Nvidia wrote.
OpenShell keeps enforcement out of the agent’s hands
OpenShell has three components: a gateway that manages the lifecycles and policies of many sandboxes, a sandbox that applies kernel-level controls to filesystem and process activity, and a supervisor paired with each sandbox to check outbound requests against policy.
All of the sandbox’s network traffic passes through the supervisor. It can inspect configured traffic and, for example, let an agent read data through an API while blocking writes. These controls stay in place even when the agent runs code it generated, and policy decisions are logged.
For API-key connections, the agent sees only a placeholder. The real key is substituted outside the agent workload, and only for authorized endpoints.