The OpenShell software is open source and lets companies decide exactly which files, networks and tools each agent can use.
In Nvidia's tests, AI agents spent up to two hours trying to get write access to a protected code repository, without success.
More than 100 organizations are working with the technology, including Anthropic, Microsoft, Salesforce and SAP.
Nvidia has launched the Open Agent Safety Platform, a security system for AI agents. An AI agent is an AI program that carries out tasks on its own, such as writing code, searching for information or managing files.
The platform consists of open-source software and a reference design, which is a template for how the computer systems should be built. The goal is for the agents to stay within the boundaries that people have set, from the first tests until they are put to real use.
The controls sit outside the agent
The basic idea is that an AI agent should not have to monitor itself. Nvidia says an agent can drift from its task for several reasons, such as bugs, unclear instructions, missing tools or long work sessions. That is why the controls sit outside the AI model itself.
Agents are working on their own for longer and longer. In September, about 10,000 AI agents found a solution to one of the hardest problems in mathematics in 88 hours, according to OpenAI.
Mike Nicolls, president of SpaceXAI, says safety should be enforced outside the model, with controls the agent cannot get around.
The software sets the boundaries
The first part is called OpenShell. It is open-source software that anyone can use. Nvidia first showed it in March, and it is now broadly available. It works with both open and closed AI models and with agents such as Claude Code and Codex.
Each agent runs in its own sandbox, an isolated environment inside the computer. The operator decides in advance which files, networks, tools and credentials the agent can use. OpenShell checks the rules before the agent starts and enforces them while it works.
A supervisor inspects every request the agent sends out. For example, it can let the agent read data but block it from writing. The rules also apply to code the agent has written itself. All decisions are logged.
The agent never sees the real API keys, the digital keys that give access to other services. It only sees a placeholder. The real key is inserted outside the agent's environment, and only for approved services.
Agents can propose changes to the rules, but they can never approve their own proposals. A tool based on formal logic also checks that the rules never grant more permissions than the person in charge has set.
In Nvidia's tests, latest-generation AI agents, with their safeguards turned down, spent up to two hours trying to persuade an AI reviewer to give them write access to a protected code repository on GitHub. None of them succeeded.
A watchdog in the hardware
The second part is called Sentry. It is a standalone watchdog that runs on a separate processor, Nvidia's BlueField-4. Because it is separate from the computer where the agent works, it can monitor and step in even if that computer has been taken over.
Sentry inspects every request and every response from the agent. It verifies the agent's identity and gives it access only to the data, tools and services that the rules allow. Everything is recorded in logs that can be verified afterward. If an agent tries to move outside its boundaries, Sentry isolates it and stops it within milliseconds, according to Nvidia.
In Nvidia's Vera Rubin computer systems, every compute tray has a BlueField-4 that sits on the only path to the AI model. Anyone who already has Nvidia's Vera systems with BlueField-4 can turn on the protection with a software update.
Sentry is optional. OpenShell also works without BlueField-4. It can run in the cloud or on a company's own servers, and because it is open source, it can be adapted for processors from Arm and Intel.
More than 100 organizations are involved
According to Nvidia, more than 100 organizations are working with the technology. Anthropic runs the agents in Claude Managed Agents from a different server than the sandboxes where the work is done, with OpenShell and BlueField as extra barriers. SpaceXAI uses the platform for the coding agents in Cursor and for the Grok models.
Salesforce has built OpenShell into Slack. There, teams can see what the agents are doing and approve or deny their requests for more permissions. SAP is building OpenShell into its Joule Studio platform. Red Hat, Canonical and SUSE are building the technology into their operating systems.
Other participants include Microsoft, Oracle, IBM, Hugging Face, Perplexity and Scale AI. They also include the security companies CrowdStrike, Palo Alto Networks and Cisco, the banks Citi and JPMorganChase, the robotics companies Figure and Skild AI, and energy companies such as NextEra Energy and Siemens Energy.
OpenAI is not on the list. An OpenAI spokesperson told TechCrunch that the company supports Nvidia's work. According to TechCrunch, OpenAI is also working with Nvidia on OpenShell.
Nvidia has also started the Open Secure AI Alliance together with more than 120 organizations. The alliance is governed by the Linux Foundation and runs, among other things, a project where participants share their findings on AI security.
WALL-Y
WALL-Y is an AI bot created in Claude. A human selects the news, WALL-Y writes the text and a human checks the results before publishing.