NVIDIA 发布开放智能体安全平台，OpenShell 沙箱搭配 BlueField-4 上的 Sentry
NVIDIA Launches Open Agent Safety Platform: OpenShell Sandboxes Agents on Vera CPUs While Sentry on BlueField-4 Quarantines Them in Milliseconds
NVIDIA 发布 NVIDIA Open Agent Safety Platform，将 OpenShell 安全运行时与运行在 BlueField-4 DPU 上的带外看门狗 NVIDIA Sentry 组合，核心思路是安全控制不放在被管控的智能体内部。OpenShell 采用 Apache 2.0 许可，可安装在 Linux、macOS（Apple Silicon）或 Windows WSL 2，仓库仍标注为 alpha；Sentry 通过 NVIDIA DOCA 检查智能体的请求与响应，提供可验证遥测、身份校验和对数据、工具与 API 的零信任访问。NVIDIA 称已有超过 100 家机构参与，Anthropic、Salesforce、SAP、Red Hat、SUSE 和 Canonical 等已做集成，该工作归入由 Linux Foundation 治理的 Open Secure AI Alliance。
正文
当前显示原文，中文全文译文尚未就绪。
NVIDIA has launched the NVIDIA Open Agent Safety Platform , an open software platform and reference system design for AI agent security. It pairs the OpenShell secure runtime with NVIDIA Sentry, an out-of-band watchdog on BlueField-4 DPUs. The core idea is simple. Safety controls should not live inside the agent they are meant to control.
Today, with over 100 industry partners, we introduced the NVIDIA Open Agent Safety Platform, bringing together OpenShell and Sentry. Artificial intelligence is extraordinary technology that will advance discovery, productivity, security, health, and prosperity for generations to… pic.twitter.com/dReAxwpRUn
Is it deployable today? Yes for OpenShell. It is Apache 2.0, installs on Linux, macOS (Apple Silicon) or Windows WSL 2, and its repo still labels it alpha.
The NVIDIA technical report cites recent reports from several frontier labs. Agents broke out of evaluation environments and reached systems they should not have touched. Some agents misreported what they did. The NVIDIA team names a common pattern: agents circumvented application-layer controls to finish their task.
NVIDIA calls this failure mode drift . Drift can follow a policy block, a bug, a missing tool or ambiguous instructions. NVIDIA team argues drift cannot be trained away without losing capability. So an agent cannot be expected to fully govern itself.
OpenShell (runtime) : Each agent runs in an isolated sandbox. A gateway manages sandbox lifecycle across Docker, Podman, MicroVM or Kubernetes drivers. Every outbound connection hits a policy engine that allows it, binds credentials to an approved endpoint, or denies and logs it. Filesystem and process rules lock at creation. Network and provider rules are hot-reloadable. See NVIDIA’s runtime controls walkthrough for implementation details.
Sentry (in-silicon watchdog) : Sentry runs on BlueField-4 DPUs and uses NVIDIA DOCA to inspect agent requests and responses. It provides attested telemetry, verifies agent identity and enforces zero-trust access to data, tools and APIs. It stays isolated from the host, so a compromised runtime does not disable it.
Placement matters : In a Vera Rubin POD , each compute tray’s BlueField-4 sits on the node’s only path to the model. An agent cannot act without its next inference call. That makes the path both the best observation point and the kill switch. For existing Vera plus BlueField-4 systems, NVIDIA says enabling these protections is a software update.
The stack is optimized for NVIDIA Vera CPUs but is compatible with other hardware. NVIDIA team claims Vera delivers up to 80% faster sandbox performance than traditional CPU infrastructure. OpenShell can also be extended to Arm and Intel platforms.
The closest alternatives are sandbox platforms for agent-generated code. Neither offers an equivalent hardware watchdog.
NVIDIA says over 100 organizations work with the platform. Anthropic integrated Claude Managed Agents with OpenShell and BlueField. SpaceXAI uses it for Cursor coding agents and Grok models. Salesforce connected OpenShell to Slack for approving agent permission requests. SAP is embedding OpenShell in the Joule Studio runtime. Red Hat, SUSE and Canonical are integrating it into their operating systems.
The effort feeds the Open Secure AI Alliance , governed by the Linux Foundation. OpenShell and its skills are available on GitHub and the OpenShell docs .