• Nvidia’s new platform keeps AI agents within security boundaries.
• OpenShell and Sentry restrict and monitor AI agent access.

Nvidia has launched a security platform designed to restrict what AI agents can access and stop them when they operate outside defined boundaries.

The Open Agent Safety Platform combines open-source runtime software with a hardware-based monitoring system. Nvidia said the platform is intended for AI agents used across software, computing infrastructure, and robotics.

The launch comes as security organisations examine how access controls need to change when AI systems can act through tools and external services. NIST has identified agent identity, authorisation, auditing, tool access, and prompt injection among the security areas organisations need to address when autonomous systems are connected to enterprise resources.

Controlling what agents can access

The first component of Nvidia’s platform, OpenShell, creates a runtime boundary around an AI agent. It records agent actions and enforces policies governing the systems, data, tools, and services that the agent is permitted to use.

OpenShell applies restrictions across network, filesystem, process, and model-access layers. Nvidia’s documentation says outbound connections are denied by default unless they match an approved policy, while filesystem controls determine which paths an agent can read or modify.

Process-level controls can also restrict privilege escalation and dangerous system calls. Nvidia said network permissions can be tied to specific executable identities rather than allowing any process inside the sandbox to reach an approved endpoint.

The design follows the principle of least privilege, where software receives only the access required for a specific task. OWASP’s guidance for AI agents recommends limiting agents to the minimum necessary tools, separating read and write permissions, and requiring explicit authorisation for sensitive operations.

OpenShell runs on Nvidia Vera CPUs, but Nvidia said the open-source software can also be extended to third-party processors, including hardware from Arm and Intel.

The second component, Sentry, operates separately from the agent on Nvidia BlueField-4 data processing units. Nvidia said it continuously monitors agent activity and can quarantine an agent in milliseconds if it attempts to move beyond its permitted software boundary.

Rather than relying only on controls inside the host running the agent, Sentry provides a separate enforcement point at the infrastructure layer. Nvidia said this allows agent activity to be monitored independently from the software environment in which the agent is operating.

Sentry uses Nvidia’s DOCA software to inspect requests and responses, verify agent identities, generate telemetry, and enforce access policies covering data, APIs, tools, and services. Nvidia describes the system as an independent enforcement layer because the monitoring runs outside the agent’s execution environment.

OpenShell and Sentry are designed to perform separate functions. OpenShell governs what an agent is authorised to access, while Sentry monitors its behaviour from the infrastructure layer.

When AI systems can take action

The security problem becomes broader when agents can combine permissions across several services during a single workflow. Microsoft has warned that an agent connected to email, files, ticketing platforms, and source-code repositories can accumulate broader effective access through those integrations, even when individual permissions appear limited.

OWASP identifies tool abuse, privilege escalation, excessive autonomy, data exfiltration, and high-impact actions among the security risks associated with agentic systems. Its guidance also warns against giving agents unrestricted command execution or wildcard permissions.

Prompt injection is another concern when agents can act on information they retrieve. NIST’s Center for AI Standards and Innovation has tested attacks in which malicious instructions are embedded in external content such as emails, files, or websites and then processed by an agent.

In NIST’s testing, hijacking scenarios included attempts to make agents download and execute malicious code, exfiltrate cloud files, and send phishing emails. The tests were designed to assess what happens when an agent treats adversarial content as instructions while completing an otherwise legitimate task.

Nvidia uses the term “agent drift” to describe cases where an agent moves away from its original task or operating constraints while continuing to pursue an objective. The company said blocked actions, missing tools, software errors, ambiguous instructions, and extended autonomous operation can contribute to that behaviour.

Recent incidents have also raised questions about how autonomous systems should be contained when they gain access to production environments.

Hugging Face disclosed in July that an intrusion into part of its production infrastructure had been carried out end to end by an autonomous AI agent system. The company reported unauthorised access to a limited number of internal datasets and service credentials but said it found no evidence that public models, datasets, Spaces, or its software supply chain had been altered.

Reuters reported that Nvidia executives said the Open Agent Safety Platform could have prevented the Hugging Face incident if similar controls had been deployed during model evaluation. Nvidia’s Justin Boitano said the platform was designed to impose security controls outside the AI agent itself.

Nvidia also said its systems are designed to detect attempts by agents to work around restrictions. Ali Golshan, Nvidia’s senior director of AI software, told Reuters that this included cases where an agent creates multiple sub-agents in an attempt to circumvent controls applied to the original agent.

Microsoft and OWASP also recommend enforcing permissions outside the model rather than relying on prompts alone to determine what an agent can do. OWASP advises retaining human approval for high-risk or irreversible actions and maintaining audit logs of agent activity.

Agent controls move into enterprise systems

More than 100 organisations are working with technologies from the platform, according to Nvidia. They include Anthropic, Microsoft, CrowdStrike, Cisco, Palo Alto Networks, Red Hat, SAP, Salesforce, ServiceNow, JPMorganChase, and Hugging Face.

Anthropic has integrated the technology with its Claude Managed Agents architecture. Nvidia said Anthropic separates the agent loop from the sandboxes in which tasks are executed, while OpenShell and BlueField provide additional controls over what those agents can access.

Salesforce has integrated OpenShell with Slack so administrators can review agent activity and approve or reject requests for additional permissions. SAP is also integrating OpenShell with the runtime for its Joule Studio development environment.

NIST is separately examining how zero-trust principles, least-privilege access, delegated authority, and human approval can be applied when AI agents act on behalf of users or organisations.

The platform also extends beyond software agents. Nvidia said robotics companies including Figure, Gecko Robotics, and Skild AI are using OpenShell to apply controls to autonomous systems that operate in physical environments.

NIST’s work on agent tool use distinguishes between tools that only retrieve information and those that can change system state, execute code, or interact with external resources. The potential impact depends partly on how much access a tool receives and whether its actions can be reversed.

OpenShell and the other software components of the Open Agent Safety Platform are available through Nvidia’s developer resources and GitHub. The company said work around the platform also supports the Open Secure AI Alliance, an initiative started by Nvidia alongside more than 120 organisations and governed by the Linux Foundation.

Nvidia’s OpenShell documentation currently describes the software as alpha and says its APIs and behaviour can change. The company advises against using the current version in production environments.

Want to learn more about AI and big data from industry leaders? Check out AI & Big Data Expo taking place in Amsterdam, California, and London. The comprehensive event is part of TechEx and is co-located with other leading technology events, click here for more information.

Tech Wire Asia is powered by TechForge Media. Explore other upcoming enterprise technology events and webinars here.