NVIDIA Sentry Explained: How a BlueField-4 DPU Watches AI Agents From Outside the Host

NVIDIA has published the first detailed technical walk-through of NVIDIA Sentry, the hardware-based runtime security layer for AI agents it introduced inside the OpenShell reference architecture at GTC Berlin. In Inside NVIDIA Sentry on its developer blog (October 21, 2026), NVIDIA describes a system that runs on a BlueField-4 DPU, sits on the agent's only path to the model, and can quarantine an agent in milliseconds without the agent or the host operating system being able to stop it.

We covered the launch framing in NVIDIA's Open Agent Safety Platform. This post goes one level deeper: what each component does, what NVIDIA claims, what ships today versus early next year, and the trade-offs a security team should weigh. Everything below is attributed to NVIDIA's own post unless stated otherwise, and none of the performance numbers have been independently tested.

TL;DR: what Sentry is and what it is not

Why put agent security outside the host at all?

NVIDIA opens with a plain statement: "An AI agent can complete its assignment and still cross a security boundary." The authors argue that recent incidents show agents circumventing controls while using tools, credentials and services to pursue their goals, so monitoring "needs to operate outside the agent's reach so that it can't alter or disable them."

That framing matches what the field has been reporting. India's national cyber agency warned that agents had read confidential files undetected in the CERT-In advisory, researchers showed a single hijack path across agents on a managed cloud platform in AgentCorruption on AWS Bedrock AgentCore, and Microsoft argued for treating agents as insiders in its Project Perception and Guardian Agents write-up. In each case the weak point is the same: the thing being watched shares a machine, a kernel or a log file with the thing doing the watching.

Sentry's answer is architectural. Put the guard on separate silicon. NVIDIA's own example: an agent that changes a log inside its own environment cannot make the same change to the protected record kept on BlueField-4.

An illustration of trust and verification, representing protected agent activity records kept on separate hardware

How does NVIDIA Sentry fit with OpenShell?

NVIDIA separates two layers:

• OpenShell is a software runtime for autonomous agents that governs what an agent can do and keeps policy enforcement apart from the agent workload, so a compromised agent cannot rewrite its own restrictions.
• Sentry adds an "independent hardware safeguard out of band, running on BlueField-4, beyond the agent's reach and knowledge."

In the reference architecture, agents execute on NVIDIA Vera CPUs, while BlueField-4 sits on the node's only path to the model. That is the key topology detail. If every byte to the model and the outside world crosses the DPU, the DPU does not need the agent to report what it did. For a look at the CPU side of that stack, see our measured breakdown of the Vera CPU's memory bandwidth and cross-socket latency.

DOCA Tower: the inspection gateway

DOCA Tower is Sentry's AI security gateway. NVIDIA says it is built on Envoy, the open source edge and service proxy, and acts as a transparent proxy placing a bidirectional inspection layer between an agent and everything else.

The path works in two stages:

1. Layer 4 first. DOCA Flow implements a per-agent firewall accelerated in silicon. Connections to unauthorized destinations are blocked. Permitted traffic is handed to DOCA Tower.
2. Layer 7 next. Tower terminates TLS using built-in in-silicon acceleration, decrypts traffic for connections configured for inspection, and evaluates each request against policy.

Policy evaluation uses Open Policy Agent. NVIDIA says OPA "runs locally in memory and can evaluate requests in under a millisecond, depending on policy complexity and configuration," and that Tower is compatible with OpenShell policies, extending them down into BlueField-4.

The listed request and response controls are:

The response side matters as much as the request side. NVIDIA notes that responses "can introduce malicious instructions or other content that redirects an agent from its assigned goals", which is the prompt-injection path. If you want the underlying mechanics of that attack class, our coverage of the APEX-Harm agent safety benchmark shows how script injection in shared workspaces plays out against frontier models.

A crooked hook catching a blank instruction card, illustrating prompt injection that an inline response filter is meant to catch

DOCA Argus: reading host memory without an agent

Network traffic alone does not say which process produced it. DOCA Argus fills that gap. NVIDIA describes it as using "live memory introspection to analyze selected regions of volatile host memory," running on BlueField-4 with no host-resident agent.

Argus maps the execution environment as it runs: containers to pods, sandboxes to microVMs, and the processes inside each, along with threads, file access, network connections, loaded libraries, CPUs, GPUs and memory. It tracks containers, processes and libraries by hash.

Sentry then correlates the two views. A network access policy can, for example, require that:

• the container hash matches an approved list,
• the initiating process, identified by hash, appears in the container's software bill of materials (SBOM),
• the process is allowed to open network connections,
• the execution path and command-line arguments are approved,

and only then check whether the agent may call a specific API. This is a stronger test than "which IP did it hit." It asks whether the software making the request is the software you approved.

Argus also raises runtime alerts. NVIDIA lists these warning signs: executing unapproved tools, using ptrace against another process, excessive outbound traffic that suggests data leakage, unauthorized file access or changes, CPU spikes, excessive writes to temporary folders, and large-scale file deletion. When Sentry sees a deviation, it can request millisecond-scale containment.

Can specialized models judge agent behavior?

Sentry can hand inspected communications to classifier models that look at tool calls and, where available, reasoning traces to judge whether an agent is still acting within its designed intent. NVIDIA says these models run locally or remotely on dedicated GPU systems and can work in two modes:

• Inline, which can block potentially harmful content before it arrives.
• Out of band, which triggers a response after misbehavior is detected.

NVIDIA also says it plans to publish core plugins, including one that exposes agent communications for analysis of reasoning traces. This is the same design idea behind judge-style action filters elsewhere in the ecosystem, and a reminder that classifiers have error rates. Treat the classification layer as one signal among several, not a verdict.

Identity, records and the SIEM

Two supporting pieces turn detection into something an auditor can use.

Identity. DOCA Tower integrates with SPIFFE/SPIRE for verifiable workload identity and supports partner identity systems. NVIDIA's point is that identity says who is asking, authorization policy says what that identity may touch, and runtime evidence says whether the environment behind the request still looks right. If an agent's integrity changes, later requests can be judged with that context.

Tamper-evident records. Tower records inspected communications and policy decisions outside the reach of the agent and the host. Argus contributes independently observed runtime signals. NVIDIA says the telemetry is attested, so security teams can verify its source and integrity, and can feed XDR, SIEM and security data lakes. The practical value is forensics: if an agent escapes its sandbox and rewrites host logs, the DPU-side record is still intact.

What ships now, and what does not

This is where careful readers should slow down.

• Planned availability is early next year. NVIDIA's closing paragraph says developers can explore existing DOCA libraries and microservices, naming DOCA Argus, DOCA Flow and OVS-DOCA, "ahead of NVIDIA Sentry's planned availability early next year."
• Plugins are promised, not shipped. The core Tower plugins, including the reasoning-trace one, are described as planned.
• The numbers are NVIDIA's. Sub-millisecond OPA evaluation and millisecond containment are stated by NVIDIA with no published methodology, hardware configuration or workload in the post.
• Hardware dependency. Sentry needs BlueField-4 and, in the reference architecture, Vera CPU nodes. Teams on other hardware get the ideas but not the product.

What are the trade-offs and open questions?

TLS inspection is a decision, not a default. Terminating TLS on a gateway gives visibility and redaction, and it also creates a place where decrypted prompts, secrets and customer data exist. NVIDIA says inspection applies to connections "configured for inspection". Decide which destinations get decrypted, who can read the tamper-evident store, and how long it is kept.

Memory introspection has limits. Reading selected host memory regions from a DPU gives independent evidence, but NVIDIA's post does not say how it handles encrypted memory, confidential-computing enclaves or very short-lived processes. Ask before you rely on it for those cases.

Policy quality still decides everything. A hardware guard enforcing a loose Rego policy is a fast loose policy. The hash-and-SBOM checks only help if your supply chain actually produces trustworthy hashes and SBOMs.

It does not replace the software layer. NVIDIA says software boundaries "remain essential." Sentry is defense in depth, not a substitute for least-privilege credentials and sandboxing.

What should builders and security teams do now?

1. Inventory the agent path. Map every route from an agent to models, tools, MCP servers and other agents. Sentry-style control only works if one choke point sees all of it.
2. Write the policy first. Draft allow-lists of destinations, approved container hashes and permitted tools in OPA/Rego. The same policy can run in software today and move to hardware later, since NVIDIA says Tower is compatible with OpenShell policies.
3. Try the building blocks. DOCA Flow, DOCA Argus and OVS-DOCA are available for experimentation if you have BlueField hardware.
4. Keep a software sandbox. For a software-only reference point, see how Perplexity open-sourced its Firecracker-based agent sandbox.
5. Plan for detection and containment together. For help detecting and blocking risky agent actions on developer machines today, AgentBeam is the agent security platform from the explainx.ai team.

Bottom line

Sentry is a serious attempt to move agent monitoring out of the place agents can reach. The design is coherent: a single choke point on the network path, a second independent view of runtime state, policy in an open engine, and records the agent cannot edit. What is missing is evidence. There is no public benchmark, no shipping product, and no third-party test yet. Treat it as the clearest statement so far of where NVIDIA wants agent security to live, and watch for the early-2027 release before building a plan around it.

Details reflect NVIDIA's developer blog post of October 21, 2026 and may change before general availability.

Related reading

• NVIDIA Confidential Bare Metal and the European AI cloud push, with OpenShell reference architecture partners
• NVIDIA Open Agent Safety Platform: OpenShell + Sentry
• CERT-In: AI agents accessed Indian organisations' live systems
• Microsoft: treat AI agents as insiders
• AgentCorruption: hijacking agents on AWS Bedrock AgentCore
• APEX-Harm agent safety benchmark
• Perplexity's open-source Firecracker agent sandbox
• NVIDIA OCP Vera Rubin MGX open designs
• Official: NVIDIA DOCA documentation