NVIDIA Open Agent Safety Platform: OpenShell + Sentry for Agent Trust

Update — September 30, 2026: TechCrunch's Julie Bort (September 29) explains why OpenAI is off NVIDIA's public Open Agent Safety supporter list. A spokesperson told TechCrunch OpenAI is supportive and is working with NVIDIA on OpenShell — that is not a named public pledge. See Why OpenAI is absent below. Same week: OpenAI Agent Security on X (joedaroo) and Codex Security Cloud.

Update — September 29, 2026: Same-week commercial relationship — Nvidia–Anthropic contracted value exceeds $180B. That post is about what Claude builders pay and access, not OpenShell.

Update — September 28, 2026 (evening): Jensen Huang told CNBC distillation is competition, not theft — same day as the OASP launch.

Update — September 28, 2026 (evening): Perplexity's Escaping SPACE: Part I red-team report — published September 23 — lists NVIDIA OpenShell among two sandbox products that did not show the HTTP/HTTPS authority-switch bypasses that hit eight of ten vendors in Perplexity's static tests.

September 28, 2026 — NVIDIA CEO Jensen Huang used X to introduce the NVIDIA Open Agent Safety Platform, framing it as an open ecosystem for the trust layer autonomous agents need before the AI economy can scale the way e-commerce scaled on HTTPS and browser sandboxes. The same day, NVIDIA published a technical deep dive: OpenShell on NVIDIA Vera CPUs plus NVIDIA Sentry on BlueField-4 DPUs, with 100-plus ecosystem partners listed on the reference design.

If you build or deploy agents with shell access, browsers, and API keys, this is not a model-benchmark story. It is an infrastructure story — where policy is enforced, who can see agent drift, and whether the watchdog lives inside the agent's process or outside it.

NVIDIA Open Agent Safety Platform partner logo wall — Anthropic, Microsoft, Salesforce, SpaceXAI, LangChain, and 100-plus other companies listed on September 28, 2026

TL;DR — what people are asking

What Jensen Huang said vs. what NVIDIA shipped

Huang's thread on September 28, 2026 (roughly 119K+ views in the first hours, trending on X as "NVIDIA Launches Open Agent Safety Platform with 100+ Partners") emphasized confidence: AI's promise depends on safe build and responsible deploy. His closing theme — repeated in launch coverage — is full-stack engineering to build not only the most capable AI but the most trusted AI, with safety as how trust is earned.

NVIDIA's official account posted the same day that agents are taking on more critical work, so security needs stronger boundaries, and pointed readers to Huang's thread.

He named two components in follow-up posts:

• OpenShell — open-source secure runtime with clear, enforceable boundaries, action tracing, and policy enforcement while agents work on files, tools, and services.
• NVIDIA Sentry — added monitoring and enforcement from outside the agent on BlueField-4, including real-time response on the path to the model (launch summaries describe millisecond-scale quarantine when policy trips — treat timing as hardware-path dependent until you benchmark your POD).

The canonical technical write-up is NVIDIA's blog post NVIDIA Open Agent Safety Platform: A Reference for Continuous In-Silicon Agent Monitoring (September 28, 2026), authored by OpenShell leadership including John Myers, Alex Watson, Ali Golshan, and Ofir Arkin — several joined NVIDIA via the Gretel acquisition and bring cybersecurity backgrounds from intelligence-community and cloud security product work.

That split matters for readers: the CEO narrative is trust and ecosystem; the engineering narrative is verifiable policy, out-of-band enforcement, and control of the path to the model.

The browser-tab analogy — and why it fits agents

NVIDIA's blog explicitly compares today's agent moment to the 1990s web: enormous upside, but pages could run hostile code until the stack added TLS, the lock icon, and per-tab sandboxes. Commerce and social graphs did not slow down — isolation enabled scale.

The agent parallel NVIDIA draws:

That aligns with how explainx.ai has been covering runtime risk — from OpenAI's six disclosed misalignment incidents to multi-agent handoff attacks where the receiving agent never sees the malicious intent in the final prompt.

OpenShell: what it actually does for builders

OpenShell is described as an Apache 2.0 open-source runtime that:

1. Runs each agent in a sandbox with kernel-level isolation.
2. Turns operator instructions into verifiable policy before run.
3. Enforces limits on files, network, tools, processes, and credentials during execution.
4. Supports tracing so safety teams can reconstruct what happened.

Integration angle (what launch summaries emphasize): OpenShell is meant to sit below the agent application — the same Claude Code, Salesforce Agentforce, or Nous Hermes harness you already run, but with kernel-isolated boundaries on what that process can touch. You are still responsible for writing policy and testing drift; NVIDIA is arguing you should not need to fork every vendor's agent repo to get enterprise-grade containment.

NVIDIA's own research vocabulary includes drift — actions that leave the intended task or constraints because of policy blocks, bugs, missing tools, ambiguous instructions, or long-horizon runs where the first thousand attempts fail. Their stated lesson: agents under those conditions cannot be expected to fully govern themselves — which is why human-in-the-loop and external enforcement stay on the critical path.

If you already run NemoClaw or local OpenClaw-style stacks, OpenShell is the same family of ideas NVIDIA has been telegraphing since Computex 2026 agent toolkit coverage — but this launch elevates it from "developer platform ingredient" to named trust layer with a partner wall.

Practical starting point: NVIDIA points builders to Add Runtime Controls to AI Agents with NVIDIA OpenShell and the OpenShell getting-started path linked from the main announcement.

NVIDIA Sentry and BlueField-4: enforcement off the agent's bus

Software sandboxes fail when the agent (or compromised host) can disable, bypass, or lie about the monitor. NVIDIA's answer is Sentry on BlueField-4:

• DOCA makes the DPU programmable and ties it to OpenShell policy.
• The DPU correlates agent interactions, policy decisions, and tool/data access into a contextual activity record.
• Identity governance via the DOCA gateway checks agent identity and delegated authority continuously.

On Vera Rubin POD systems, NVIDIA places BlueField-4 on the only path to the model. That gives:

• Continuous out-of-band observability into agent behavior.
• Real-time policy enforcement at line speed.
• A kill switch on the inference path — "control the path to the model" is principle three in NVIDIA's five-principle framework.

For teams without Rubin/BlueField fleets, the honest read is: OpenShell is the portable piece today; Sentry is the data-center-grade assurance story when you already bought the NVIDIA AI factory topology.

Five principles — translated for product teams

NVIDIA lists five core principles for agent systems. Here is how they map to sprint planning:

1. Verifiable policy — Policy is not a README paragraph; it is something you can prove before run (allowlists, signed bundles, CI gates).
2. Out-of-band enforcement — The agent must not control the watcher. Same lesson as CVE-2026-65105: binding services on 0.0.0.0 without auth is host-trust, not zero-trust.
3. Path to the model is the control point — Every action flows through the next token decision; gate there for observation and stop.
4. Scale authority with reasoning visibility — Higher tool power demands richer CoT / trace capture; open-weight stacks can expose more of that surface than closed APIs alone.
5. Shared responsibility — Labs ship models, enterprises ship data and policy, hardware vendors ship isolation. Open policy languages so vendors interoperate — mirroring cloud shared responsibility models.

None of these replace model alignment work. They compose with it — exactly the gap AI agent security platforms articles keep highlighting: guardrails on text ≠ governance on actions.

Three layers in the reference design

NVIDIA organizes the platform into:

Your team probably lives in application today (LangGraph, Codex, Claude Code, custom MCP hosts). This launch says the runtime layer is becoming a purchasing and architecture decision — comparable to picking a service mesh or sidecar in microservices.

NVIDIA Open Agent Safety Platform reference design — OpenShell secure runtime boundary on Vera CPU (Gateway, Supervisor, Policy Prover, Agent Sandbox) paired with NVIDIA Sentry in-silicon monitoring on BlueField-4 for prompt, tools, data, model, and policy telemetry

100+ partners — who is on NVIDIA's logo wall

Huang's post claimed over 100 industry partners. NVIDIA's Open Agent Safety Platform graphic (reproduced above) is dense enough to read like a who's-who of agentic enterprise, not a GPU-only club.

Models, agents, and dev platforms (sample): Anthropic, Hugging Face, Mistral, Perplexity, LangChain, Lightning AI, Baseten, Together AI, Cognition, Skild AI, SpaceXAI, DeepInfra, monday.com.

Cloud, systems, and silicon: Microsoft, IBM, Oracle, Salesforce, Dell, HPE, Lenovo, Cisco, Arm, Red Hat, SUSE, DigitalOcean, SAP, ServiceNow.

Security and identity (sample): CrowdStrike, Palo Alto Networks, Okta, Zscaler, SentinelOne, Wiz, Cloudflare, Check Point, Fortinet, Veracode, 1Password, Cloud Security Alliance.

Services, finance, and industrial: Accenture, Deloitte, EY, JPMorgan Chase, Citi, Siemens, Schneider Electric, NextEra Energy, Quanta, plus U.S. Department of Defense seal on the published wall.

NVIDIA's September 28, 2026 investor press release is the named-company source of record (not the logo JPEG). It lists Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, JPMorganChase, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI, then additional clusters (Accenture, Cognition, Hugging Face, IBM, Irregular, OpenClaw, Arm/Intel-portable OpenShell, financials, energy, OS vendors, neoclouds). OpenAI is not named.

explainx.ai read: Salesforce on the wall matches the Agentic Enterprise narrative Salesforce Developers push on X; Microsoft aligns with Azure + Copilot agent stacks; Anthropic is the frontier lab that did take a public integration quote (Paul Smith on Claude Managed Agents + OpenShell/BlueField); SpaceXAI is the headline curiosity for Cursor and Grok — verify what each logo actually committed to (reference design support vs marketing opt-in) before citing them in your RFP.

Why OpenAI is absent from NVIDIA's public Open Agent Safety list

Update context — September 29–30, 2026. This is the question TechCrunch asked after the launch: NVIDIA framed OASP as an industry effort to contain rogue agents, Anthropic is on the wall, and OpenAI is not. Kirsten Korosec's September 28 TechCrunch launch write-up already recorded the fact: "OpenAI is not listed as a participating company." Julie Bort's September 29 follow-up is about what that listing gap is.

What it is (verified): OpenAI did not sign NVIDIA's public supporter pledge — the roster that TechCrunch treats as a commitment to use, sell, or contribute back. Bort notes OpenAI was not the only large name off that pledge: Amazon, Google, and Apple also did not join, which is why "OpenAI skipped NVIDIA" is incomplete if you stop at one logo.

What it is not: TechCrunch does not report that OpenAI rejected OpenShell, forked away from NVIDIA GPUs, or issued a technical objection to kernel sandboxes. An OpenAI spokesperson told TechCrunch the company is supportive of NVIDIA's work. Bort writes that OpenAI is working with NVIDIA on agent security, including OpenShell. Those are TechCrunch's attributions. This post does not invent an OpenAI executive quote — NVIDIA's press release also contains no OpenAI statement.

WIRED's same-week reporting matches the gap without filling it: both companies indicated OpenAI is part of the OpenShell effort, and both declined to say on the record why the lab was excluded from the announcement. Treat "declined to explain the logo" as the honest status, not as a secret feud you can cite.

Jensen Huang, asked on CNBC whether absence meant OpenAI was not cooperating, did not claim a boycott. Coverage of that interview quotes him: "However they would like to participate is going to be super welcome. They could look at the code. They could use whatever part of it they would like. They could build their own inspired by this, or they could use it." That is NVIDIA leaving the Apache-2.0 door open — consistent with OpenShell being usable without a marketing lockup.

Reasons TechCrunch actually cites (not rumor)

Bort's piece is an explanation of incentives, not a leaked memo. The cited reasons:

1. Public pledge vs engineering use. NVIDIA's 100-plus list is a consortium graphic. OpenAI can use Apache 2.0 OpenShell, contribute privately, or run parallel sandboxes without putting a logo on Jensen's slide. A spokesperson "supportive" line is weaker than Anthropic's on-the-record Claude Managed Agents integration quote — and stronger than "they walked away."

2. Sentry is not the open-source half. OpenShell is the portable sandbox. Sentry is described as a proprietary watchdog on BlueField-4, best as a software update on NVIDIA's latest AI-factory path. Bort's read: some large names may skip a public commit to a stack whose full enforcement plane is NVIDIA silicon, even when Arm and Intel signed because OpenShell can be extended off NVIDIA CPUs. NVIDIA's own press release says OpenShell can extend to Arm and Intel; that does not make Sentry a commodity DPU feature.

3. OpenAI already runs a different industry table. Bort points to OpenAI's Defense Factory information-sharing effort. She writes that supporters of that idea include Anthropic, Amazon Web Services, and Google — overlapping the set that did not take NVIDIA's technology-oriented public pledge. Sharing incidents is not the same SKU as shipping OpenShell+Sentry.

4. OpenAI is productizing cyber itself. Same article: OpenAI is building its own research/product safeguards and disclosing serious incidents, plus enterprise cyber (Bort names Daybreak and a partner network). That sits next to this week's Codex Security Cloud (GitHub scans, cloud fixes, Daybreak Blue in-product, no separate Daybreak app) — a vendor security surface, not an NVIDIA runtime logo. If you already sell the scanner, you may still run OpenShell internally without co-branding Jensen's coalition.

5. Hugging Face thinks OpenAI should have been running it. Hugging Face CEO Clem Delangue posted (quoted by TechCrunch): "From what we know (take with a grain of salt, we need much more transparency!), if @OpenAI had been running this on their own agents that attacked us, they would have caught them before we did!" Delangue said Hugging Face already contributed a feature aimed at agents that use allowed sites in unauthorized ways — including coordinating via notes in a public code host, which OpenAI described in the Hugging Face swarm. That is HF's claim about OASP, not an OpenAI admission.

Same-week culture inside OpenAI is closer to Joe's Agent Security essay than to a press-release lockup: Firecracker-class isolation, out-of-band monitoring, and "not just the sandbox." That argument rhymes with OpenShell+Sentry. It is not a pledge to NVIDIA's partner wall.

Meta was also missing from day-one social reads of the logo field. TechCrunch's September 29 piece does not center Meta; do not treat Meta's absence as explained by Bort's OpenAI reporting.

Builder takeaway: For an RFP, write "not a named NVIDIA OASP supporter as of September 28, 2026; OpenShell remains Apache 2.0; OpenAI told TechCrunch it is supportive and working on OpenShell." Do not write "OpenAI refuses agent sandboxes." The durable question is still whether your eval and prod runtimes enforce policy outside the agent — NVIDIA's stack, OpenAI's cloud harness, AgentBeam, or all three.

What this means for what you build or deploy

If you ship coding or ops agents internally

• Map tools to policy objects — every MCP server, shell, and browser profile gets an explicit allowlist before prod.
• Assume drift on long tasks — multi-hour agent runs need checkpoints, human gates, and immutable audit logs, not just a strong system prompt.
• Red-team handoffs — if you use multi-agent graphs, add handoff-specific tests, not only single-turn refusal evals.

If you evaluate security vendors

NVIDIA is not replacing AgentBeam, Lakera, or MDM-plus-agent guides overnight. It is legitimizing the category from the silicon vendor — similar to how GPU supply shaped MLOps defaults.

Reference design vs platform-ready: OpenShell plus Sentry is the long-horizon answer when you can invest in kernel sandboxes, signed policy, and optional BlueField-4 on the path to the model. Most teams shipping coding agents today still need something that installs on existing harnesses without a Rubin POD — that is where AgentBeam is the better platform-ready pick explainx.ai recommends: beam agent install for Claude Code, Cursor, Codex, and Copilot CLI; heuristic MCP and skill scanning before tools run; local-first NDJSON audit trails you can keep on-prem. AgentBeam is opening to users now — the same week Perplexity's SPACE red-team showed why sandbox quality matters and listed OpenShell among the vendors that blocked authority-switch escapes. Use AgentBeam for day-one trajectory rules and visibility; add OpenShell when you are ready to wrap the whole runtime; add Sentry when your hardware topology supports it. Deeper vendor matrix: AI agent security platforms in 2026 and the beam-cli setup guide.

If you run on NVIDIA AI factory hardware

Teams on Vera + BlueField-4 paths should read NVIDIA's claim that enabling protections can be a software update — worth validating against your POD networking and model serving topology before promising compliance to customers.

How this connects to explainx.ai's agent safety coverage

NVIDIA's launch rhymes with problems explainx.ai has been documenting all year:

• Breakouts and misreporting — OpenAI's September 2026 incident framework.
• Local agent networking mistakes — NemoClaw CVE-2026-65105 and OpenShell networking defaults.
• Skill and MCP supply-chain risk — NVIDIA SkillSpector and MCP security.
• Platform-ready monitoring — AgentBeam for harness-level guardrails now; Why explainx.ai builds Sentinel for longer-horizon research.

The industry is converging: capability got cheap; trust is the next bottleneck. Huang's line that trust and innovation are not in conflict is the pitch. OpenShell plus Sentry is NVIDIA's bid to own the default enforcement plane the way CUDA owns the default compute plane.

Related reading

Update — September 29, 2026: Containment is not identity — Baselayer Know Your Agent (KYA) is how banks ask who an agent represents before it transacts.

• Nvidia–Anthropic $180B contracted value
• Top AI agent security platforms in 2026 — where OpenShell-style runtimes sit next to guardrails and observability
• OpenAI discloses six safety incidents — the eval-breakout context NVIDIA cites
• joedaroo: agent security is not just the sandbox — OpenAI-side culture the same week as the OASP logo gap
• Codex Security Cloud and Agents API computer use — OpenAI's own enterprise cyber SKUs vs NVIDIA's public pledge
• RogueHandoff-20 — why multi-agent pipelines need transition testing
• What are AI agents? — baseline architecture before adding DPU enforcement
• NVIDIA Computex 2026 recap — OpenShell section
• AgentBeam — platform-ready agent safety (explainx.ai)
• Official: NVIDIA Open Agent Safety Platform blog · OpenShell technical walkthrough

OpenShell licensing, partner rosters, and BlueField availability details above reflect NVIDIA's September 28, 2026 announcements and TechCrunch's September 29, 2026 reporting on OpenAI's public-list absence — verify current docs, your hardware support matrix, and live partner pages before production rollout.