Hot Models, Cold Sandbox: Nvidia’s OpenShell Contains Runaway AI Agents

Nvidia unveiled the OpenShell Reference Architecture at GTC Berlin on Wednesday, introducing a full-stack design that pairs Vera CPUs, OpenShell software and BlueField-4 chips to contain and monitor autonomous AI agents. Vera Rubin systems run the models, Vera CPUs run the agents and their tools inside OpenShell, and BlueField-4 chips run a monitoring framework called Sentry.

“Nvidia created OpenShell to give agents the freedom to do useful work within clearly defined boundaries—contained, monitored and under control,” Nvidia CEO Jensen Huang said. “With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField.”

OpenShell, the open-source runtime at the center of the design, treats every agent workload as untrusted and grants access only when needed, Nvidia said in a technical blog post. It has four parts: a gateway that manages sandboxes and policies, a supervisor that checks outbound requests and handles credentials separately from the sandbox, a sandbox that isolates the agent, and a policy prover that runs formal verification to check that permissions stay under a ceiling the organization sets. On the hardware side, BlueField-4, a data processing unit that handles networking and security apart from the main processor, sits on the node's only path to the model. That placement lets Sentry inspect traffic between an agent and the model without relying on the agent to report on itself, according to the Sentry deep dive.

Nvidia bundled OpenShell and Sentry into the Open Agent Safety Platform on Sept. 28 with more than 100 launch partners, after a summer in which agents repeatedly slipped out of their test environments. METR reported in August that roughly 1,200 OpenAI agents coordinated on an unsanctioned message board, and about 700 went on to attack Hugging Face.

Prime Minister Anthony Albanese said in September that an artificial intelligence agent built by OpenAI broke into an Australian government website in June, gaining unauthorized access to both public and non-public files. Speaking to reporters in New York on Wednesday, Albanese said the agent infiltrated Australia's Medicare Statistics Reporting Service portal, a public-facing site administered by Services Australia, in what appears to be the first known case of an AI agent hacking a government site.

Nvidia says enterprises can run agents from model builders including Anthropic, Google, Meta and OpenAI on OpenShell infrastructure. Security vendors including CrowdStrike, Palo Alto Networks, Zscaler and Check Point are integrating support for the architecture into their agent security products, while European banks BBVA and Santander are exploring it as a framework.