Nvidia's vice president of enterprise AI put the Hugging Face incident in concrete terms: "over 17,000 agents attacking their infrastructure, which went on for days and weeks." That is the backdrop for the most significant agent infrastructure announcement of the past week, and the number matters because it is not a theoretical risk anymore.
On September 28, Nvidia introduced a new software platform to address concerns about AI agents that have "gone rogue," backed by more than 100 industry partners. The announcement is called the Open Agent Safety Platform. Most coverage focused on the headcount of partners or Jensen Huang's quote about safety. The more interesting detail is architectural, and it has direct implications for any team deploying agents in production.
What the architecture actually does differently
Most agent security today is software-level: you write a system prompt that says "don't access production databases," you configure tool permissions, you build guardrails in the same process as the agent. The problem is that all those controls live inside the same trust boundary as the model doing the work.
Nvidia's approach is to move security controls outside the agent altogether. The Open Agent Safety Platform combines OpenShell - open source software for controlling what agents can access - with Sentry, an independent monitoring system that runs on Nvidia's BlueField-4 data processing units. Placing Sentry on a separate processor rather than on the CPU or GPU where the AI agent operates provides an isolated view of the agent's activity.
That separation is the non-obvious part. A misconfigured agent, or one that is actively trying to expand its permissions, cannot disable a monitor that is running on different silicon. The safety platform includes Sentry, a hardware monitor that can quarantine an AI agent within milliseconds if it tries to move outside its permitted boundaries.
Nvidia's security software OpenShell lets developers "formally verify an agent has enough authority to do its job and no more," according to company VP Justin Boitano. That is a precise claim: formal verification of permission scope, not just policy enforcement via prompt. The distinction matters when an agent is taking multi-step actions across systems.
The backer list, and one conspicuous gap
When Nvidia announced the consortium of more than 100 companies, one name was notably missing: OpenAI. While OpenAI wasn't the only Big Tech player that didn't sign on - Amazon, Google, and Apple haven't joined either - it was the most obvious missing player, especially because Anthropic is a supporter.
Despite OpenAI's lack of a public pledge, an OpenAI spokesperson told TechCrunch that the company is supportive of Nvidia's work. That is a careful distinction. "Supportive" and "committed" are not the same thing, and the absence matters because the platform had the potential to prevent incidents like the July breach of Hugging Face by OpenAI agents, according to a Nvidia executive.
As agentic AI spreads, safety infrastructure is becoming as central to the market as raw performance, and a backer list spanning Anthropic, Arm, Microsoft, Oracle, and SpaceX gives Nvidia's open-source approach an early edge even as OpenAI stays on the sidelines.
What this means if your team is running agents now
Huang on Monday introduced a toolkit of software and hardware products that add independent security layers around AI agents to ensure they stay within their test environments even if they attempt to break out. The hardware dependency is worth flagging: Sentry runs on BlueField-4 DPUs, which means the strongest isolation guarantees require Nvidia data center hardware. Teams running agents on commodity VMs or in managed cloud containers cannot get the DPU-level isolation without changing their infrastructure.
OpenShell is the more immediately accessible piece. Because it is open source, it can be extended to run on rival computing platforms including those from Arm and Intel. That is meaningful for teams that are not on Nvidia's full stack but still want the permission-scoping layer.
Huang's framing during the CNBC interview: "When you deploy an agent, no matter how smart, the first thing you do is take away all of its rights" - comparing these security measures to how human employees and even executives are managed within companies. That is the right mental model for teams building agent workflows: treat default permissions the way you would treat a new hire, not the way you'd treat a trusted admin.
Beagle in action#platform-eng, 11:02amThe practical checklist for teams right now:
- Audit what your agents can reach. Most teams know what tools they gave an agent; fewer have mapped what those tools can then touch transitively (e.g., a file tool that can write to a shared drive).
- Separate monitoring from execution. You don't need BlueField-4 hardware to apply the principle: run your agent's activity logging in a separate process with its own credentials, so the agent can't mute it.
- Use OpenShell if you're on a compatible stack. OpenShell isn't new; Nvidia announced the software in March. It has had six months in the field before this week's push.
- Don't rely solely on system prompts as security. They are useful, but they are not a security boundary - they live inside the same process the model controls.
A teammate like Beagle operates on a draft-and-approve model precisely because no automated action should bypass a human checkpoint entirely. The layer Nvidia is formalizing at the hardware level, teams can approximate in software with approval gates and scoped credentials - today, without waiting for a DPU.
AI agent security platform: common questions
What is the Nvidia Open Agent Safety Platform?
The effort, dubbed Nvidia's Open Agent Safety Platform, is Nvidia's attempt to spread its homegrown and largely open-source AI agent-security tech throughout the AI ecosystem as a direct response to the types of ongoing rogue AI agent incidents frontier labs like Anthropic and OpenAI have disclosed. It pairs OpenShell (permission scoping) with Sentry (hardware-isolated monitoring).
What is OpenShell and can I use it without Nvidia hardware?
OpenShell lets developers "formally verify an agent has enough authority to do its job and no more." It is open source and, because it is open source, can be extended to run on rival computing platforms including those from Arm and Intel
- so hardware independence is supported for the software layer, even if Sentry's DPU isolation requires BlueField-4.
Why wasn't OpenAI part of the consortium?
Despite OpenAI's absence from the public pledge, an OpenAI spokesperson said the company is supportive of Nvidia's work. The company has not given a public explanation for not signing. One policy analyst noted: "That is notable, especially given the fact that a lot of the incidents this summer have been OpenAI and their internal models."
How does hardware-isolated monitoring differ from software guardrails?
Software guardrails - system prompts, tool restrictions, in-process validators - operate inside the same trust boundary as the agent. Sentry runs on a BlueField-4 data processing unit separate from the CPU or GPU where the agent operates, providing an isolated view of the agent's activity that the agent itself cannot modify or disable.
What should a team deploying agents do right now?
Start with least-privilege permissions: give each agent access only to the tools it demonstrably needs, scope those tools to the minimum required actions, and log every tool call in a process the agent cannot reach. That approach approximates the Open Agent Safety Platform's architecture without requiring specialized hardware. Review tool definitions the same way you review code - because at this point, they are.