Nvidia ships an open-source sandbox for agents and a hardware watchdog that quarantines them

The pattern Nvidia cites from recent incidents is that an agent got around controls at the application layer to finish its task. The answer it proposes sits below the agent: a runtime that enforces policy in the kernel, and for data centers a separate chip that watches the agent from outside its trust domain. The runtime is free software you can install today. The watchdog needs Nvidia hardware.

What OpenShell does

OpenShell runs each agent in an isolated sandbox. Kernel controls decide which files it can read and which system calls it can make, and every outbound network connection passes a policy check before it leaves the sandbox. Agents never see real credentials: the runtime adds them only to requests bound for approved endpoints.

Before a policy change is applied, OpenShell uses formal verification to flag what new access it would grant, such as reaching a new host with credentials or calling a new API method, and holds those changes for human review. The repository is licensed under Apache 2.0. It runs on Linux, on macOS with Apple silicon, and experimentally on Windows with WSL 2, and it needs Docker, Podman, or host virtualization. SDKs exist for Python, TypeScript, Go, and Rust.

One detail to read before installing: the gateway collects anonymous telemetry by default, limited to operational categories and counts. It can be switched off with an environment variable or compiled out.

What Sentry adds

Sentry is the reference system design. It runs on BlueField-4 data processing units, outside the CPU and GPU that run the agent, and Nvidia says it monitors agent behavior and quarantines an agent that tries to leave its boundary in milliseconds. It is built on DOCA software, which inspects agent requests and responses, verifies agent identity, and enforces zero-trust access policies for data, tools, APIs, and services.

OpenShell itself is tuned for Nvidia's Vera CPU, but as open-source software it can be extended to Arm and Intel platforms, according to the company. The hardware watchdog has no such path: it is Nvidia silicon or nothing.

Who is on board

Nvidia's summary names Anthropic, Cisco, CrowdStrike, Dell, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI, and the company says more than 100 organizations work with the platform's technologies, OpenClaw among them. Anthropic's Claude Managed Agents run the agent loop on a separate server from the sandboxes, and Nvidia says integrations with OpenShell and BlueField let enterprises control agent access through those sandboxes.

Three integrations are concrete. Salesforce and Nvidia connected OpenShell to Slack, so a team can see agent activity and approve or reject requests for more permissions from a channel. SAP is embedding OpenShell in the Joule Studio runtime. SpaceXAI says it uses the platform for Cursor coding agents and Grok models.

The umbrella is the Open Secure AI Alliance, initiated by Nvidia with more than 120 organizations and governed by the Linux Foundation. It runs the Shared AI Findings Exchange, or SAFE.