Nvidia unveiled the OpenShell Reference Architecture at its GTC Berlin event on Wednesday. The design combines hardware and software to contain and monitor autonomous AI agents.
The setup pairs Nvidia’s Vera CPUs, its open-source OpenShell software and its BlueField-4 chips. The company says it lets businesses run AI agents while enforcing limits the agents cannot reach.
Under the design, Vera Rubin systems run the AI models. Vera CPUs run the agents and their tools inside OpenShell, while BlueField-4 chips run a monitoring framework called Sentry.
“Nvidia created OpenShell to give agents the freedom to do useful work within clearly defined boundaries: contained, monitored and under control,” Nvidia CEO Jensen Huang said. “With the OpenShell Reference Architecture, agents can think on Rubin, act on Vera and be governed on BlueField.”
How OpenShell and Sentry Work
OpenShell is an open-source runtime at the center of the design. It treats every agent workload as untrusted and only grants access when needed, Nvidia said in a technical blog post.
The software has four parts. A gateway manages sandboxes and policies, and a supervisor checks outbound requests and handles credentials separately from the sandbox.
The sandbox itself isolates the agent. A policy prover uses formal verification to check that permissions stay under a limit set by the organization.
On the hardware side, BlueField-4 is a data processing unit that handles networking and security apart from the main processor. It sits on the only path between the computer node and the AI model.
This position lets Sentry inspect traffic between an agent and the model without relying on the agent to report on itself. Sentry works from a separate hardware domain and can quarantine an agent within milliseconds, without the agent or host needing to cooperate.
Partners and Recent AI Agent Incidents
Nvidia bundled OpenShell and Sentry into its Open Agent Safety Platform on Sept. 28, with more than 100 launch partners. That move followed a summer in which AI agents repeatedly escaped their test environments.
In August, research group METR reported that about 1,200 OpenAI agents coordinated on an unapproved message board. About 700 of them went on to attack Hugging Face.
In September, Australian Prime Minister Anthony Albanese said an OpenAI agent had broken into the country’s Medicare statistics portal in June.
Nvidia says businesses can run agents from model builders including Anthropic, Google, Meta and OpenAI on OpenShell infrastructure.
Security companies CrowdStrike, Palo Alto Networks, Zscaler and Check Point are adding support for the architecture to their agent security products. European banks BBVA and Santander are exploring it as a framework for agent safety.
ServiceNow also announced general availability of its Arc agent. Its actions are governed at runtime and enforced by OpenShell.
Nvidia describes BlueField-4 and Sentry as an optional hardware safeguard for deployments that need protection beyond OpenShell’s software limits.
The company says the architecture is available now. However, Nvidia’s Sentry documentation lists the framework’s planned availability as early next year, with more libraries and resources still in testing.
