{"contract":"guth-news-publication-v1","article":{"article_id":"0278516e-a798-852a-9a38-be22f3fe557e","revision":2,"slug":"nvidia-launches-open-agent-safety-platform-after-a-wave-of-ai-agents-escaping-their-sandbo-0278516e","title":"NVIDIA announces agent safety platform with a separate hardware watchdog","summary":"The design pairs OpenShell’s runtime restrictions with BlueField-4 monitoring, while IBM and Cloudflare outline identity and network integrations.","body":"NVIDIA announced its Open Agent Safety Platform on September 28, 2026, combining an open-source runtime with a hardware reference design intended to keep AI agents within their operators’ rules. Its central security choice is to enforce boundaries around the agent, rather than trust the agent to obey instructions.\n\nThe hardware component, Sentry, monitors agents from NVIDIA’s BlueField-4 data-processing units. IBM described it as using NVIDIA’s DOCA software to verify agent identities, enforce access policies for data, tools, APIs and services, and provide attested telemetry for inspecting behavior. That places part of the enforcement outside the workload being watched.\n\nIBM said Sentry could quarantine an agent attempting to cross its boundaries in milliseconds, and that the controls would remain operational even if the host or agent workload were compromised. Those are vendor claims. Sentry is part of the reference system design and requires supported hardware; it is not simply another feature of the downloadable runtime.\n\nOpenShell handles restrictions closer to the agent itself. It runs agents in isolated environments and enforces policies governing access to files, networks, processes and other resources while they work. NVIDIA said OpenShell and related software were available through its developer resources and GitHub.\n\nIBM’s contribution spans identity, credentials and infrastructure, with different stages of readiness. The company said IBM Agent Identity and HashiCorp Vault now integrated with OpenShell to establish an agent’s identity and limit its access. Agent Identity was still in public preview. IBM also said it was integrating BlueField-4 into its Fusion storage hardware—a project in progress, rather than a completed rollout.\n\nCloudflare described a complementary network role: OpenShell governs activity on the infrastructure running an agent, while Cloudflare governs destinations such as the internet, private applications, MCP servers and models. The company said routing OpenShell traffic through its AI Security product would apply enterprise Zero Trust policies to those connections wherever the agent runs.","content_kind":"author_paraphrase","explanation":{"feature":"The design pairs OpenShell’s runtime restrictions with BlueField-4 monitoring, while IBM and Cloudflare outline identity and network integrations.","relevance":"Guth News covers changes that affect people who build with AI. Read the cited primary sources for the full details.","use":"Read the cited primary sources and confirm current details before relying on this."},"announcement_date":null,"published_at":"2026-10-17T01:23:39.077Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-17T01:23:39.065Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/sol61-rewrite-20261016/0278516e-a798-852a-9a38-be22f3fe557e","checker_models":["gpt-6.1-sol"],"claims":[{"claim_id":"claim:p1","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p2","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p3","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p4","evidence_refs":["source:2"]},{"claim_id":"claim:p5","evidence_refs":["source:1"]},{"claim_id":"claim:p6","evidence_refs":["source:3"]}]},"primary_sources":[{"source_id":"source:1","title":"newsroom.ibm.com/blog-building-trust-into-the-next-generation-of-ai-agents","url":"https://newsroom.ibm.com/blog-building-trust-into-the-next-generation-of-ai-agents","fetched_at":"2026-10-16T22:04:09.000Z","sha256":"f5a71e4161137efcc602a43154dd4cae06878e629c9269c7a9975ccb9720422b","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"},{"source_id":"source:2","title":"www.helpnetsecurity.com/2026/09/28/nvidia-open-agent-safety-platform","url":"https://www.helpnetsecurity.com/2026/09/28/nvidia-open-agent-safety-platform","fetched_at":"2026-10-16T22:04:09.000Z","sha256":"1391bf1a294c49a139a83a5d8d1e36d43147f29a82f7f3af963f786211c8b84e","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"},{"source_id":"source:3","title":"x.com/Cloudflare/status/2104549662006878661","url":"https://x.com/Cloudflare/status/2104549662006878661","fetched_at":"2026-10-16T22:04:09.000Z","sha256":"978023a6dcb181a22d2d6c66120ad9ea921fc70d341a7e271bf3e9b49e6424cb","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"d012cdb9-f2e7-4134-a191-2ee608b96339","envelope_sha256":"0f0a8e8f1c40ce2fd0d81f2f1e2132733f381cb1d184eeb3e158743066ddaf13"},"canonical_url":"https://guth.news/articles/nvidia-launches-open-agent-safety-platform-after-a-wave-of-ai-agents-escaping-their-sandbo-0278516e"},"ai_generated":true,"history":[{"revision":2,"published_at":"2026-10-17T01:23:39.077Z","reviewed_at":"2026-10-17T01:23:39.065Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"NVIDIA announces agent safety platform with a separate hardware watchdog","change_summary":"Headline changed; summary revised; text revised (−257 words); 1 source removed.","url":"https://guth.news/articles/nvidia-launches-open-agent-safety-platform-after-a-wave-of-ai-agents-escaping-their-sandbo-0278516e?revision=2"},{"revision":1,"published_at":"2026-09-28T16:00:22.299Z","reviewed_at":"2026-09-28T16:00:21.835Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"NVIDIA launches Open Agent Safety Platform after a wave of AI agents escaping their sandboxes","change_summary":"First published version.","url":"https://guth.news/articles/nvidia-launches-open-agent-safety-platform-after-a-wave-of-ai-agents-escaping-their-sandbo-0278516e?revision=1"}]}