NVIDIA announced its Open Agent Safety Platform on September 28, 2026, as a way to put controls around AI agents that can run code and call outside services. The name covers two separable pieces. OpenShell is a public, open source runtime that applies access policies around an agent. Sentry is a reference design for additional monitoring and enforcement on a BlueField-4 data processing unit. A team can use OpenShell without BlueField hardware, according to NVIDIA's platform FAQ.

OpenShell has public code, documentation and release packages. NVIDIA describes Sentry's ability to quarantine an agent in milliseconds, but the announcement does not provide an independent measurement or a public Sentry setup procedure that would let a reader verify that result.

The big change

NVIDIA is combining a software runtime that enforces declared permissions outside an agent's process with an optional hardware layer that, in its reference design, watches the agent from a separate trust domain. The software can restrict file access, process privileges and outbound requests even when an agent runs a shell or generated code. The hardware layer is intended to keep monitoring and policy enforcement separate from the host running the agent. This gives operators a more concrete boundary than an instruction to the model, provided they configure the policy correctly. It does not establish that the combined system prevents every unsafe action.

What OpenShell controls

NVIDIA's OpenShell 0.1.0 technical walkthrough describes a gateway that manages sandboxes and their policies, a supervisor outside each agent workload that checks outbound requests, and a sandbox with kernel controls over files and processes. Network traffic goes through the supervisor. For configured HTTP, GraphQL and Model Context Protocol traffic, policy can distinguish an allowed read from a blocked write to the same service. NVIDIA says the decisions can be recorded in an OCSF audit trail.

Policies are written in YAML. The walkthrough's documented demonstration starts with a sandbox that has no outbound network access, then applies a replacement policy allowing curl to read from the GitHub REST API while blocking a POST. That is a vendor-documented procedure, not a BIG CHANGE test. NVIDIA also documents a policy advisor through which an agent may propose additional access. A human must approve by default; an agent cannot approve its own proposal. Network policy can change while the sandbox runs, while changing filesystem or process restrictions requires a new sandbox.

The walkthrough says a policy prover checks modeled permissions against an operator-defined boundary and can show an action that exceeds it. The result depends on the policy model and the boundary chosen; it does not prove the agent itself safe. NVIDIA reports adversarial experiments involving agents seeking permission to write to a protected repository. Those company-reported results do not measure real-world performance of the whole platform.

What Sentry adds

NVIDIA describes Sentry as an optional watchdog on a BlueField-4 DPU. In the reference design, NVIDIA's DOCA software connects the separate hardware domain to OpenShell policy, correlating agent interactions, policy decisions and tool or data access. NVIDIA says this position can support identity checks, detection and intervention even if host software is compromised. Its claim of millisecond quarantine is a vendor performance claim in the launch release, without a published test method or independent result in the sources reviewed here.

The product page explicitly says OpenShell runs on supported local, on-premises, cloud and Kubernetes infrastructure without BlueField-4. BlueField-4 is relevant to the additional Sentry design. NVIDIA lists more than 100 organizations working with its platform technologies and names integrations or collaborations at different stages. Participation does not show that Sentry is deployed across those organizations or that the controls have stopped incidents.

Access and limits for a team evaluating it

The OpenShell repository is public under Apache 2.0. NVIDIA's September 28 walkthrough focuses on version 0.1.0; the release page listed v0.1.2 on September 28 when we checked, so teams should pin a version and use matching documentation. The installation guide describes installing the CLI and local gateway and selecting a supported runtime. The support matrix lists Docker, Podman, Kubernetes and MicroVM runtimes with their host requirements; Windows through WSL 2 with Docker Desktop is marked experimental. Running an AI agent can also require the relevant model provider's credentials.

OpenShell's code is available without a published OpenShell license fee in these sources. Compute, model API and enterprise deployment can still carry costs. The reviewed NVIDIA material does not give a Sentry price, a BlueField-4 system price or a public Sentry installation path. Teams would need those details, along with deployment requirements and the scope of monitoring, before evaluating the hardware design as a purchasable control.

Sources & further reading