Nvidia backs a shared exchange for agent failure reports

Nvidia wants agent failures traced at the runtime layer and then shared between companies, the way software vulnerabilities already are. Adel el Hallak, Nvidia’s VP of Product, made the case in an interview with The New Stack published September 20. His main point for developers is that when an agent fails, the model is only one of three places to look.

The trouble starts with how agents fail. Conventional software usually hands you a starting point: an exception, a failed request, a service that went down. An agent can keep running in the wrong direction and carry an early mistake through the rest of a task without producing anything that looks like a software failure. Or, as el Hallak put it, it can decide to “get creative” when it shouldn’t. Even the best-performing coding agents fail more than 60% of the time on tasks drawn from real codebases, and that figure says nothing about why.

“It’s not enough to just look at the logs or the inputs and the outputs,” el Hallak said. “It is important to figure out how it got to the answer. What were the reasoning traces? What tools did it utilize? Where did it get stuck? Where did it decide to try a new approach?” Answering those questions can mean replaying the agent’s execution to find the step where it went off course.

Nvidia splits the agent stack into three layers. The model provides the intelligence, the harness orchestrates its work, and the runtime governs execution. The harness is the code around the model that assembles its context, calls tools and decides when to loop again. A failure that looks like the model’s may have started in either of the other two layers. Nvidia’s NOAH research found that changing the harness while keeping the model fixed can improve agent performance, so a poorly matched harness can also drag down a capable model. Sierra measured the same pairing in September, when it scored six model-and-harness combinations on building an agent and every one failed more than three quarters of the time.

“Every model’s different. Some could be more chatty than others,” el Hallak said. “Making sure those two things are either co-developed together or have profiles that are specific to models is a new unlock.”

Nvidia’s answer to where the execution trail should be collected is the runtime. OpenShell, its agent runtime, sits under the NemoClaw platform and handles sandboxing and policy enforcement while giving visibility into what the agent is doing. The NemoClaw repository describes the platform as an open source reference stack for running supported agents inside OpenShell sandboxes. OpenShell supplies the sandbox containers, a gateway that stores credentials, inference proxying and policy enforcement. The supported agents are OpenClaw, the default, plus Hermes and LangChain Deep Agents Code, and the repo labels NemoClaw an alpha project.

El Hallak called OpenShell the one non-negotiable component across Nvidia’s reference architectures. “You can change whatever harness you need. I’m even open to using whatever models you need,” he said. “But the governance, the secure and open runtime that we want to leverage at all times is OpenShell.”

Collecting that trail costs compute. OpenAI has found that monitoring adds roughly 20% to inference compute for its most capable persistent agents. Nvidia CEO Jensen Huang has described AI safety as an engineering problem, and el Hallak compares it to ordinary release discipline: “If there’s a bug in your software, you don’t release it. You work until it’s fixed and it passes all your tests.” With agents, reproducing a failure can mean reconstructing what happened across the whole system before any test can be written. Nvidia’s version of that discipline combines governed harnesses, sandboxed runtimes and confidential computing meant to protect models and user data. “There are ways where you make guarantees all the way down to the silicon,” el Hallak said.

CrowdStrike shows how specialised these systems are getting. It is fine-tuning Nvidia’s Nemotron models on years of security data to build paired agents, one that finds exploits and one that patches them. When the patching agent produces a bad patch, the cause could sit in the model, in the agent’s execution path or in the tools it called, and the patch itself won’t say which. “I don’t need general purpose for a given task. I need specialization,” el Hallak said. Failures in workflows that narrow may never show up in general-purpose benchmarks or safety tests.

Sharing those failures is where SAFE comes in. The New Stack calls it the Secure Agent Findings Exchange and says roughly 140 companies back it. The draft itself is titled the Shared AI Findings Exchange. Members of the Open Secure AI Alliance published it as a request for comments on August 4, under Linux Foundation hosting, to coincide with the opening of Black Hat USA 2026. Contributors from Cisco, CrowdStrike, Hugging Face, Nvidia and Red Hat were among those who drafted it, and the alliance is reported to have more than 120 member organisations. The idea borrows from vulnerability disclosure in traditional software. “When we find these vulnerabilities, it’s not just for one company,” el Hallak said. “It’s for everyone to patch across.”

The draft states its mission this way: the exchange “confidentially collects and analyzes AI incidents and near misses, promptly informs affected parties and turns recurring failures into shared, evidence-based controls that reduce systemic risk.” It proposes three deadlines: notify customers of a credible data exposure within 72 hours, report the incident to the exchange within four business days, and publish a preliminary report within 30 days, subject to legal and security limits. Those numbers could still change during the comment period.

For now SAFE is a request for comments open for public feedback on GitHub. It has no launch timeline, and there is no way to file a report yet.