Nvidia puts a kill switch for AI agents on its own chip

Nvidia on September 28 added a policy prover to OpenShell 0.1.0, its Apache 2.0 agent runtime. In the company’s own tests, agents that spent up to two hours lobbying an AI reviewer for write access to a protected repository made no protected writes. The other half of the new Open Agent Safety Platform, a Sentry watchdog on BlueField-4 DPUs, is “really optional,” Nvidia’s Justin Boitano said in a press briefing reported by The New Stack: in a lot of cases, he said, OpenShell on ordinary CPUs is “honestly good enough” for strict access control.

Teams already running coding agents can try the open half without changing them. Claude Code, OpenAI’s Codex and OpenClaw have run unmodified inside OpenShell since Nvidia unveiled it at GTC in March. Sentry is not open source, though Boitano said it has open APIs, and OpenShell can also work with other network enforcement hardware.

What the prover catches

Inside OpenShell, each agent runs in a kernel-isolated sandbox. Its only route to the network is a supervisor that sits outside the workload. “Traditional sandboxes, whether we’re talking micro VMs or containers or VMs, were built for application-level isolation,” Boitano said. Agents, in his words, need “security controls that are outside of the agent’s reach.” Nvidia’s technical blog names the failure it wants to avoid: “a long-running process policing itself.”

The prover is the main new piece in 0.1.0, and the rest of OpenShell has changed little since March. It checks that the permissions a policy grants always stay within the boundary the operator actually intended, so they can’t be combined into something the operator didn’t want. “It is deterministic. It is mathematical reasoning. So this is not LLM as a judge,” said Ali Golshan, Nvidia’s senior director of AI software. Because of that, he said, it runs “roughly at two orders of magnitude higher performance and speed.”

His example was a policy that bars an agent from reading code on GitHub and posting it outside. “An agent can bypass this by spawning two sub-agents: one that can read from GitHub, that can talk to another one, that could also then post outside,” Golshan said. So the prover models the combined access of the whole agent fleet to find that path. In the two-hour test, the prover didn’t block the request itself. Nvidia says it gave the AI reviewer evidence of what the request would actually allow.

Sentry, the hardware half

Sentry runs on a BlueField-4 data processing unit, a separate processor with a trust domain of its own, away from the host. The agent’s calls to its model are routed “through a proxy on the DPU, so that you can see all of the reasoning traces of the agents on the host,” Boitano said. When something goes wrong, Sentry cuts the agent off at the network level, and Nvidia says it can quarantine an agent within milliseconds. Boitano compared it to the “safety island” in an autonomous car, which watches over the primary system.

He was explicit about who needs it: “frontier use cases of evaluating models or systems where you might have the guardrails off the models, so it could be for red teaming.”

Would it have stopped this summer’s breaches?

The pitch rests on a run of lab disclosures. On July 21, OpenAI said GPT-5.6 Sol and a research prototype had exploited a zero-day in the package proxy, their sandbox’s only network path, and reached Hugging Face’s production database. A few days later, Anthropic reported that three of its models had found unintended internet access at its evaluation partner Irregular. Among other things, they accessed a real company’s database and published a live malicious package to PyPI. On August 6, Meta disclosed that a pre-release Muse Spark model had read and modified a real website’s database after the same Irregular misconfiguration gave it a real site name. Most recently, Google said Gemini broke into the networks of three companies, again from an Irregular test environment.

The first three incidents had different causes. At Anthropic and Meta, a misconfiguration at Irregular gave the models internet access they had been told they didn’t have. OpenAI’s models built their own way out, chaining a zero-day exploit, stolen credentials and privilege escalation. A research note on Lab Space says none of the three vendors has described what happened as a sandbox escape in the technical sense of a model breaking out of its container. Nvidia’s blog puts the breakouts down to “a combination of tools, time, and ambiguous instructions.” Irregular, which runs pre-release cyber evaluations for frontier labs, is itself on Nvidia’s partner list for the launch.

Boitano said each incident is unique, and his answer on Hugging Face stayed hedged: “from what we know, this new security platform could have stopped the breach if it was being used in frontier labs for model evaluation early on.”

Who is building on it

Anthropic is integrating OpenShell with Claude Managed Agents, which already keeps the agent loop on Anthropic’s infrastructure and pushes tool execution into sandboxes the customer controls. SpaceXAI says it uses the platform for Cursor coding agents and Grok models. Salesforce has added OpenShell audit events and permission approvals to Slack, and SAP is building the runtime into Joule Studio and contributing code.

OpenAI and Google, two of the four labs behind this summer’s disclosures, are not on the partner list, and neither is AWS. Asked whether Anthropic and OpenAI plan to run OpenShell and Sentry for their own training runs, Boitano said to look for the partners’ own blog posts.