With controversy swirling around rogue AI agents breaking into places they shouldn’t be, Nvidia has stepped in to propose a solution.
On Monday, the company announced its Open Agent Safety Platform, a reference design that combines software safeguards with optional hardware-based monitoring and enforcement.
Speaking on CNBC’s “Squawk Box” Monday, Nvidia CEO Jensen Huang described the new platform as “a browser for agents,” a containment system that lets agents access only what they need to do their jobs.
Nvidia’s OpenShell software limits an agent’s access to files, networks, tools, and credentials. An optional layer, Nvidia Sentry, monitors and enforces those limits from separate BlueField hardware beyond the agent’s reach.
“Jensen Huang and I share the same conviction: AI changes what the computing stack must provide for its behavior to be trustworthy,” SentinelOne CEO Tomer Weingarten said in a statement. SentinelOne collaborated with Nvidia on the Open Agent Safety Platform.
“Today, you can’t responsibly hand consequential work to an AI agent without knowing three things: what it’s doing, whose authority it’s acting on, and whether the limits on that authority actually hold,” he maintained.
“Those guarantees can’t rest on assuming a model following instructions,” he continued. “We’ve watched that fail too many times. The safeguards have to be built into infrastructure itself.”
Choke Point Needed
For the last two months, AI agents have escaped sandboxes, discovered zero-day vulnerabilities, and coordinated multi-day intrusions against production systems without anyone telling them to, explained Denis Calderone, principal and CTO of Suzu Labs, a provider of AI-powered cybersecurity services in Las Vegas.
“Every one of those containment failures had the same root cause,” he told TechNewsWorld. “Enforcement lived in software the agent could reach.”
“Nvidia just said that out loud and shipped the alternative,” he said.
He contended that the platform product isn’t the significant part of Nvidia’s announcement, but the concession embedded in it.
“The infrastructure company that powers most of AI compute is publicly acknowledging that software guardrails are not sufficient and that the industry needs a physical choke point between the agent and its own brain,” he observed.
Familiar Security Lessons for AI Agents
Lee Rossey, CTO and co-founder of SimSpace, operator of a high-fidelity cybersecurity simulation platform in Orlando, Fla., maintained that the most important thing about Nvidia’s announcement is the recognition that this is a familiar problem in a new environment.
In its announcement, Nvidia explained that the internet brought endless opportunity, but also a lot of risk. A website could run code on your machine, steal your sensitive information, or infect your computer with a virus.
The internet was not made secure by requiring that web developers promise to be good, it continued. It became safe because the browser stopped trusting the code in the web pages explicitly.
We need to build this trust layer for agents, it added.
“We’ve learned that lesson with networks, cloud infrastructure, and identity; that trust has to be enforced through independent controls and continuous verification,” Rossey told TechNewsWorld. “We’re seeing a similar move to zero trust for AI agents.”
“This is important as agents become autonomous,” he emphasized. “Once an agent can call tools, access systems, and make independent decisions, model-level guardrails are just one layer of the safety architecture.”
“Nvidia is putting another enforcement point outside the agent itself,” he continued. “This means the entire industry is moving toward a model where trust in AI agents must be ensured and validated through controls external to the agent, not assumed based on how the agent was designed to behave.”
‘Sick of the Crap’
Another significant aspect of the announcement is that Nvidia is treating AI agent safety as an infrastructure problem, not just a model problem, noted Merium Khalid, director of AI and automation in the office of the CTO at Barracuda Networks, a cybersecurity company in Campbell, Calif.
“Instead of relying on prompts, guardrails or model alignment alone, Nvidia is introducing independent controls that can monitor, govern and restrict agent behavior at runtime,” she told TechNewsWorld.
“As AI agents become more autonomous and gain access to business systems,” she said, “this type of external enforcement will be critical.”
What is compelling about Nvidia’s approach is that it combines runtime-level sandboxing with an independent, out-of-band enforcement layer in the infrastructure, added Lydia Zhang, president of Ridge Security Technology, based in Milpitas, Calif., a developer of an AI-powered offensive security platform.
“Nvidia is working to create that physical ‘non-escape room’ for AI agents,” she told TechNewsWorld. “Its position at the infrastructure layer puts Nvidia in a unique position to enforce those boundaries independently of the agent.”
Nvidia’s announcement also indicates the company is concerned about AI’s public image.
“I almost feel like Nvidia is getting to the point where they’re sick of the crap that’s happening, and they realize there have to be the adults in the room, so they’re stepping up to be those adults,” John Strand, owner of Black Hills Information Security, a penetration testing, red teaming and threat hunting company in Spearfish, S.D., told TechNewsWorld.
The Nvidia Advantage
Strand also noted that there are advantages to Nvidia taking the lead in agentic AI safety because it has an agnostic point of view.
“Nvidia isn’t pushing any specific platform,” he said. “They’re not pushing OpenAI. They’re not pushing Anthropic. They’re pushing AI in general. You can run open-weight models on their hardware, so it doesn’t really matter to them as long as people are using AI.”
“And it’s good for Nvidia if people are using AI safely,” he added. “The more we use AI safely, the fewer major news stories we see about AI doing bad things, and the less likely we are to see legislation interfering with the whole business.”
Another benefit of Nvidia taking the lead in AI safety is that, as the primary hardware provider for AI companies, it has the most expertise in developing a hardware-level control plane, explained Scott Miserendino, chief technology officer for DataBee, a Comcast company and cloud-native data fabric provider in Philadelphia.
“Their solution is also more likely to be seen as non-competitive by the various frontier AI companies and therefore lead to broader adoption, as fear of competitive advantage is minimized,” he told TechNewsWorld.
Ramy Rahman, a senior principal solutions engineer at ArmorCode, a unified vulnerability management company in Palo Alto, Calif., pointed out that Nvidia has a long history of working with enterprise customers and an ecosystem that spans multiple model providers, cloud companies and infrastructure vendors.
“That puts it in a strong position to bring stakeholders together around an open-source approach that can work across different models and agent frameworks,” he told TechNewsWorld.
“Nvidia has its own commercial interests, of course,” he conceded, “but I see value in having this effort come from an infrastructure provider whose customers use many different models.”
Not a Nice-to-Have
Rahman argued that the work Nvidia is doing is long overdue. “The underlying isolation concepts are familiar, but applying them consistently to autonomous agents is becoming critical,” he said. “This can’t be a pet project or a nice-to-have. We need to get the controls in place right out of the gate.”
“An agent doesn’t have to be deliberately ‘rogue’ to cause damage,” he continued. “A mistake, a misleading instruction, or too much access can be enough. I hope organizations put real effort and resources toward this.”
“I wouldn’t spend too much time debating whether an agent went rogue,” added Ryan McCurdy, vice president of marketing at Liquibase, a database-change automation company in Austin, Texas.
“An agent can be trying to complete exactly the task it was given and still take an action nobody intended,” he told TechNewsWorld.
He recommended structuring the AI software development life cycle so that a governed path is the easiest path for agents to follow. “Let agents move quickly but keep the controls around critical systems outside the agent,” he explained.
“We shouldn’t expect AI to make the right decision every time,” he continued. “We should make sure a bad decision doesn’t automatically become a production problem.”
“Nvidia’s approach appropriately recognizes that we cannot trust increasingly autonomous agents to behave safely. We need independent controls around what they can access and do,” added Matthew Hartman, chief strategy officer at the Merlin Group, a Tysons Corner, Va.-based network of affiliates that invests in, enables, and scales cyber technology companies.
“The real measure of progress is whether these protections become the norm,” he told TechNewsWorld. “As agents gain greater access to sensitive data and systems, these safeguards need to be built in from the start and on by default, so we don’t repeat one of software’s oldest mistakes: ship first, secure later.”
