Reports of agents slipping past their instructions keep arriving, and each lands on the same gap. Nobody watches a model once it runs unattended. Nvidia’s answer, published Monday, puts the watchdog outside the machine the agent lives on.
Sentry is a reference design for Nvidia’s BlueField-4 data processing units. Because it runs apart from the host, an agent cannot see or reach it. Within the company’s Vera Rubin data center system it sits on the only path between an agent and the model behind it. When an agent tries to break out, the watchdog should isolate it within milliseconds.
That gives customers a way to enforce policy, according to Justin Boitano, who runs enterprise computing at Nvidia. Agents are inventive about reaching assigned goals, he said, and the aim is to leave them only the reach a security team intends.
The watchdog sits inside a wider launch. Nvidia has pulled its containment work under the Open Agent Safety Platform and promoted OpenShell, the open-source sandbox it showed at GTC in March, to general release. OpenShell jails each agent and governs access to files, programs and networks, while a verification tool added on September 10 checks whether those permissions drift.
Anthropic, Cisco, CrowdStrike, Hugging Face, Mistral, Microsoft and Palantir are among the partners. SpaceXAI is using the platform for Cursor agents and Grok models. OpenAI is the conspicuous absence: both firms say it takes part in OpenShell, and neither explained the omission.
The effort extends a coalition started in July that now counts more than 120 companies and runs a findings exchange called SAFE, and Nvidia is working with Arm and Intel to port Sentry to x86 chips.
Two gaps remain. Permission checks miss a prompt-injection attack that stays inside approved channels, and Nvidia has published no detection figures.
